8 vulnerabilidades · DevOps · ⚡ Nuclei Orden: CVSS EPSS Año ID
CVE-2019-11253
Kubernetes DevOps Web ⚡ nuclei
7.5
HIGH
EPSS
83.8%
2019 CWE-20 0 PoCs

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Scanner Automatizado
nuclei -t CVE-2019-11253.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-11248
Kubernetes DevOps ⚡ nuclei
6.5
MEDIUM
EPSS
91.0%
2019 CWE-419 1 PoC

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

Scanner Automatizado
nuclei -t CVE-2019-11248.yaml ⎘
CVE-2019-6793
Software Genérico DevOps ⚡ nuclei
N/A
UNKNOWN
EPSS
5.3%
2019 2 PoCs

An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.

Scanner Automatizado
nuclei -t CVE-2019-6793.yaml ⎘
CVE-2019-10475
Jenkins build-metrics Plugin DevOps Web ⚡ nuclei
N/A
UNKNOWN
EPSS
92.4%
2019 2 PoCs

A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.

Scanner Automatizado
nuclei -t CVE-2019-10475.yaml ⎘
CVE-2019-15043
Software Genérico DevOps Web ⚡ nuclei
N/A
UNKNOWN
EPSS
90.9%
2019 2 PoCs

In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.

Scanner Automatizado
nuclei -t CVE-2019-15043.yaml ⎘
CVE-2019-10405
Jenkins DevOps Web ⚡ nuclei
N/A
UNKNOWN
EPSS
79.8%
2019 0 PoCs

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

Scanner Automatizado
nuclei -t CVE-2019-10405.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2019-16097
Software Genérico DevOps Web Windows ⚡ nuclei
N/A
UNKNOWN
EPSS
93.6%
2019 6 PoCs

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.

Scanner Automatizado
nuclei -t CVE-2019-16097.yaml ⎘
CVE-2019-1003000
Script Security Plugin DevOps ⚡ nuclei
N/A
UNKNOWN
EPSS
94.4%
2019 8 PoCs

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

Scanner Automatizado
nuclei -t CVE-2019-1003000.yaml ⎘