Archive
17 November 2024
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
High 7.7
Kube-controller-manager: malformed hpa v1 manifest causes crash
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
-
High 7.4
Undertow: cookie smuggling/spoofing
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional coo…
-
High 7.5
Samba: check attribute access rights for ldap adds of computers
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This i…
-
High 8.1
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users …
-
High 7.5
In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.
-
High 7.5
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows un…
-
High 7.5
In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.