7 vulnerabilidades · DevOps · ⚡ Nuclei Orden: CVSS EPSS Año ID
CVE-2023-7028
🔥 KEV GitLab DevOps ⚡ nuclei
10.0
CRITICAL
EPSS
93.8%
2023 CWE-640 19 PoCs

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Scanner Automatizado
nuclei -t CVE-2023-7028.yaml ⎘
CVE-2023-49103
🔥 KEV Software Genérico DevOps Web Cloud ⚡ nuclei
10.0
CRITICAL
EPSS
94.3%
2023 5 PoCs

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additional

Scanner Automatizado
nuclei -t CVE-2023-49103.yaml ⎘
CVE-2023-27482
core DevOps Web ⚡ nuclei
10.0
CRITICAL
EPSS
88.6%
2023 CWE-287 1 PoC

homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the S

Scanner Automatizado
nuclei -t CVE-2023-27482.yaml ⎘
CVE-2023-2825
GitLab DevOps ⚡ nuclei
10.0
CRITICAL
EPSS
92.2%
2023 7 PoCs

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

Scanner Automatizado
nuclei -t CVE-2023-2825.yaml ⎘
CVE-2023-32077
netmaker DevOps Web ⚡ nuclei
7.5
HIGH
EPSS
86.6%
2023 CWE-321 0 PoCs

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Scanner Automatizado
nuclei -t CVE-2023-32077.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2023-22478
KubePi DevOps Web ⚡ nuclei
7.3
HIGH
EPSS
81.1%
2023 CWE-862 0 PoCs

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Scanner Automatizado
nuclei -t CVE-2023-22478.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2023-22480
KubeOperator DevOps Web ⚡ nuclei
7.3
HIGH
EPSS
75.6%
2023 CWE-285 0 PoCs

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Scanner Automatizado
nuclei -t CVE-2023-22480.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB