86 results · Feed
-
Low 3.1
Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
-
Medium 6.3CVE-2020-8554 Public exploit
Kubernetes man in the middle using LoadBalancer or ExternalIPs
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…
-
High 7.5
It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate cer…
-
Low 3.1
Kubernetes in OpenShift3 Access Control Misconfiguration
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
-
Critical 9.8
Authorization bypass in Openshift
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
-
High 7.7
Access Restriction Bypass in kubernetes
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.