THREATIST.IORead the docs OpenShift Container Platform 4.6.1 image security update
Released 2020-10-27 · Red Hat rating Moderate · View on Red Hat →
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package.
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows.
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate pri…
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the proces…
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking.
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory.
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard af…
Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB.
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets.
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2.
Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen.
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS).
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x.
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests.