Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
suse rancher vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2021-36778
A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions before 2.5.12; Rancher versions before 2.6.3.
Suse Rancher
4.3
CVSSv2
CVE-2021-25313
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote malicious users to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions before 2.5.6.
Suse Rancher
4.3
CVSSv2
CVE-2019-13209
Rancher 2 up to and including 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by th...
Suse Rancher
4.3
CVSSv2
CVE-2019-11881
A vulnerability exists in Rancher 2.1.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legit...
Suse Rancher 2.1.4
1 Github repository
4
CVSSv2
CVE-2021-32001
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, wit...
Suse Rancher Rke2 1.20.8
Suse Rancher Rke2 1.21.2
Suse Rancher Rke2 1.19.12
Suse Rancher K3s 1.20.8
Suse Rancher K3s 1.21.2
Suse Rancher K3s 1.19.12
4
CVSSv2
CVE-2019-12274
In Rancher 1 and 2 up to and including 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a...
Suse Rancher
3.6
CVSSv2
CVE-2022-21951
A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value...
Suse Rancher
NA
CVE-2020-10676
In Rancher 2.x prior to 2.6.13 and 2.7.x prior to 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.
Suse Rancher
NA
CVE-2023-32186
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 prior to 1.24.17+rke2r1, from v1.25.0 before v1.25.13+r...
Suse Rancher Rke2 1.28.1\\+rke2r1
Suse Rancher Rke2
NA
CVE-2022-43760
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the malicious user to stea...
Suse Rancher
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »