Oleg Sushchenko

**Name of the Vulnerable Software and Affected Versions** Quay (affected versions not specified) **Description** A flaw was found in Quay, where clickjacking allows an attacker to trick a user into clicking on a button or link on another page. The config-editor page is vulnerable to clickjacking, which could allow an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance. Clickjacking is a technique used by attackers to trick users into clicking on something different from what they intend, by using multiple transparent or opaque layers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Quay (affected versions not specified) **Description** A flaw was found in Quay, allowing cross-site request forgery (CSRF) attacks to force a user to perform unwanted actions in an application. The config-editor page, used to configure the Quay instance, is vulnerable to CSRF. By coercing the victim's browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance, including adding users with admin privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Advanced Cluster Management for Kubernetes (RHACM) (affected versions not specified) Red Hat Advanced Cluster Security (RHACS) for Kubernetes (affected versions not specified) **Description** The issue is related to a Server-Side Request Forgery (SSRF) vulnerability, which may allow an attacker to elevate privileges and gain unauthorized access to protected information. An unauthenticated SSRF vulnerability was found in the console API endpoint, missing an authentication check, allowing unauthenticated users to make requests. **Recommendations** For Red Hat Advanced Cluster Management for Kubernetes (RHACM), consider restricting access to the console API endpoint until a patch is available. For Red Hat Advanced Cluster Security (RHACS) for Kubernetes, as a temporary workaround, consider disabling the vulnerable functionality related to server-side request forgery until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Ansible Automation Platform versions 1.2 through 2.0 **Description** The issue concerns cross-site scripting in the automation controller UI. Specifically, the project name is susceptible to XSS injection, which could lead to security issues. **Recommendations** For Red Hat Ansible Automation Platform versions 1.2 through 2.0, consider sanitizing user input for project names to prevent XSS injection until a patch is available. As a temporary workaround, restrict the ability to create or edit project names to minimize the risk of exploitation.