The issuer resolution logic in the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 does not correctly enforce authorization. An authenticated user whose approval policy only permits a namespace-scoped issuer may obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer they are not authorized to use. The attack requires valid cluster credentials and low privileges.
Amazon Web Services · AWS Private CA Connector for Kubernetes
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The format-fixing GitHub Actions workflow of the Monkeytype repository runs on pull_request_target with write permissions and executes code from a fork pull request. An external contributor whose pull request receives the format label can run arbitrary code, read the GITHUB_TOKEN and push repository content or modify pull requests and issues. The typing test application and user data are not affected.
monkeytypegame · Monkeytype
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Tailscale Android build versionCode 297862600 exports a broadcast receiver without a permission or caller check. A locally installed app with no permissions can send a broadcast that changes the VPN exit-node setting, the allow-LAN-access setting, or the connect/disconnect state of the VPN. The exit node must already exist in the victim's netmap, and the connect action may require the system VPN consent on a fresh profile. The CVE record itself describes the issue only as insecure permissions, and the CVSS 9.1 score and CWE-732 are from NVD and could not be confirmed on NVD at the time of research.
Tailscale · Android app
Research and translation in progress – available shortly.
Shelter versionCode 445 (F-Droid version 1.9.1) exports an activity that accepts intents from any app without a permission. According to a third-party advisory, a local app with no permissions can register its own auth_key on a Shelter instance that was never enrolled and then use the app's binder service and change its preference state. Once a key is enrolled, the stored key is required, so the main risk is during first setup. The NVD score of 9.8 assumes network access, which the advisory does not confirm, so this should be treated as a risk from other apps on the same device.
PeterCxy · Shelter
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
