CVE-2021-25745

HIGH Year: 2021
CVSS v3 Score
8.1
High
CVSS v2 Score
5.5
Medium
Weakness Type
CWE-20
View all →

Vulnerability Description

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Related Vulnerabilities

CVE-2007-5928

HIGH
CVSS:8.1(High)

OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is...

CWE-202007

CVE-2012-2248

HIGH
CVSS:8.1(High)

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.

CWE-202012

CVE-2013-4751

HIGH
CVSS:8.1(High)

php-symfony2-Validator has loss of information during serialization

CWE-202013

CVE-2014-2271

HIGH
CVSS:8.1(High)

cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, w...

CWE-202014

CVE-2014-5282

HIGH
CVSS:8.1(High)

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.

CWE-202014