Traversing a path into the Home Assistant Supervisor API without a token
An unauthenticated allow-list matched a string while a proxy client normalised a path, three times in a row.
found by Joseph Surin and Victor Kahan, elttam
containers
Half-blind: SSRF in Kubernetes dynamic provisioning via StorageClass parameters
kube-controller-manager will connect to any address you write into a StorageClass, and until 2020 it read the response back to you in a PersistentVolumeClaim event.
found by Brice Augras (Groupe-Asten) and Christophe Hauquiert (Nokia)