Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and…
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view…
Potential security vulnerabilities have been identified in Hewlett Packard Enterprise OneView Software. These vulnerabilities could be remotely exploited to allow authentication bypass, disclosure of sensitive information, and denial of service.
Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version…
A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ESR console. An attacker could exploit this vulnerability by sending a crafted request to an affected…
A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to…
В первой и второй предыдущих статьях на данную тему мы рассматривали аномалии выборной статистики по 125 избирательному округу по партийным спискам на выборах в Государственную Думу 2021 года, теперь сместимся по Подмосковью северо-западнее и рассмотрим электоральные аномалии…
Установка клиента Outline (shadowsocks) одним скриптомПонадобится любая версия OpenWRT (проверялось на 19.07, 21.02, 22.03 и 23.05-rc1) и установленные пакеты kmod-tun и ip-full, а так же настроенный сервер Outline (shadowsocks)Рекомендую роутер не меньше чем с 128 Мб ОЗУ, будут показаны варианты установки в ПЗУ и ОЗУ.Использоваться будет пакет xjasonlyu/tun2socks Читать далее
Недавно я с интересом прочитал на Хабре сразу две свежие статьи с рассуждениями о том, насколько наблюдаемая реальность похожа на компьютерную симуляцию, или, иными словами, какова вероятность того, что мы живём в компьютерной симуляции. Первая (автор @igor_zvyagin)…
Delta Electronics' CNCSoft-B version 1.0.0.4 and DOPSoft versions 4.0.0.82 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.