A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header openshift/router: openshift/router: cloud metadata SSRF via FQDN-typed EndpointSlice bypasses destination validation ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image openstack-ironic: Prevent rehoming resources to nodes with different owner sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golan…