CVE-2024-42480

CRITICAL Year: 2024
CVSS v3 Score
9.9
Critical
Weakness Type
CWE-284
View all →

Vulnerability Description

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.

Related Vulnerabilities

CVE-2019-12648

CRITICAL
CVSS:9.9(Critical)

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on ...

CWE-2842019

CVE-2019-5162

CRITICAL
CVSS:9.9(Critical)

An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause the...

CWE-2842019

CVE-2020-10731

CRITICAL
CVSS:9.9(Critical)

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be di...

CWE-2842020

CVE-2021-25320

CRITICAL
CVSS:9.9(Critical)

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach ...

CWE-2842021

CVE-2021-26334

CRITICAL
CVSS:9.9(Critical)

The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged use...

CWE-2842021

CVE-2022-20777

CRITICAL
CVSS:9.9(Critical)

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute...

CWE-2842022