https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:18:26 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-03596 bdu:2022-03596 https://cve.radiocsirt.org/vuln/bdu:2022-03596 https://cve.radiocsirt.org/vuln/bit-minio-2021-43858 <p><strong>Affected:</strong> Bitnami: minio</p> <p>MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.</p> <p><strong>Affected:</strong> Bitnami: minio</p> <p>MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.</p> https://cve.radiocsirt.org/vuln/bit-minio-2021-43858 https://cve.radiocsirt.org/vuln/certfr-2022-avi-097 certfr-2022-avi-097 https://cve.radiocsirt.org/vuln/certfr-2022-avi-097 https://cve.radiocsirt.org/vuln/cnvd-2022-08921 cnvd-2022-08921 https://cve.radiocsirt.org/vuln/cnvd-2022-08921 https://cve.radiocsirt.org/vuln/euvd-2026-32758 EUVD-2026-32758 https://cve.radiocsirt.org/vuln/euvd-2026-32758 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43858 <p>MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.</p> <p>MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43858 https://cve.radiocsirt.org/vuln/gsd-2021-43858 gsd-2021-43858 https://cve.radiocsirt.org/vuln/gsd-2021-43858 https://cve.radiocsirt.org/vuln/rhsa-2022:0735 <p>nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-json-schema: Prototype pollution vulnerability fastify-static: open redirect via an URL with double slash followed by a domain moby: `docker cp` allows unexpected chmod of host file moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversal golang.org/x/crypto: empty plaintext packet causes panic containerd: Unprivileged pod may bind mount any privileged regular file on disk minio: user privilege escalation in AddUser() admin API node-fetch: exposure of sensitive information to an unauthorized actor nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account</p> <p>nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-json-schema: Prototype pollution vulnerability fastify-static: open redirect via an URL with double slash followed by a domain moby: `docker cp` allows unexpected chmod of host file moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversal golang.org/x/crypto: empty plaintext packet causes panic containerd: Unprivileged pod may bind mount any privileged regular file on disk minio: user privilege escalation in AddUser() admin API node-fetch: exposure of sensitive information to an unauthorized actor nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account</p> https://cve.radiocsirt.org/vuln/rhsa-2022:0735 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1524 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, seine Privilegien zu erweitern, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, seine Privilegien zu erweitern, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1524