Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
can modify a generated .linkr manifest (for example by adding a new entry with a malicious URL) and when a user runs the extract command the client downloads the attacker-supplied file without verification. This enables arbitrary file injection and creates a potential path to remote code execution if a downloaded malicious binary or script is later executed. Version 2.0.1 adds a manifest integrity check that compares the checksum of the original author-created manifest to the one being extracted and aborts on mismatch, warning if no original manifest is hosted. Users should update to 2.0.1 or later. As a workaround prior to updating, use only trusted .linkr manifests, manually verify manife
d update to 2.0.1 or later. As a workaround prior to updating, use only trusted .linkr manifests, manually verify manifest integrity, and host manifests on trusted servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mohammadzain2008/Linkr/security/advisories/GHSA-6wph-mpv2-29xv - https://github.com/mohammadzain2008/Linkr/commit/182e5ddaa51972e144005b500c4bcebf2fd1a6c0
CVE ID: CVE-2025-59335 State: PUBLISHED Published: 2025-09-22T16:13:23.838Z Last Updated: 2025-09-22T17:26:51.453Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: cubecart Products: v6 Problem Types: CWE-613 Description: CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has n
er the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvv - https://github.com/cubecart/v6/commit/4bfaeb4485dd82255a108940a163af5ba4583b52 - https://github.com/cubecart/v6/commit/62d9be8416aa6fd7343f8932d98c5b112b163e26
CVE ID: CVE-2025-59336 State: PUBLISHED Published: 2025-09-16T16:59:17.505Z Last Updated: 2025-09-16T18:26:11.699Z Vendors: lumen-oss Products: luanox Problem Types: CWE-22, CWE-23 Description: Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This causes the uploaded file to be stored at the relative path location. If planned carefully, this could overwrite a runtime file and cause the website to crash. This vulnerability is fixed by 0.1.1. Additional Anal
his could overwrite a runtime file and cause the website to crash. This vulnerability is fixed by 0.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lumen-oss/luanox/security/advisories/GHSA-42c5-x4pj-4p3w - https://github.com/lumen-oss/luanox/commit/2b6237f3baaa1d905c491fca29f8301835721c46 - https://github.com/lumen-oss/luanox/commit/5198640c9644e2fcef5809f83b9ab0a9b4d0eeb2
CVE ID: CVE-2025-59337 State: PUBLISHED Published: 2025-10-01T20:41:45.833Z Last Updated: 2025-10-02T15:56:54.652Z Vendors: discourse Products: discourse Problem Types: CWE-77 Description: Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-7xjr-4f4g-9887 - https://github.com/discourse/discourse/commit/43
ithub.com/discourse/discourse/security/advisories/GHSA-7xjr-4f4g-9887 - https://github.com/discourse/discourse/commit/43536b60d012cc8084e7e701d6afab9ba01e28a5
CVE ID: CVE-2025-59339 State: PUBLISHED Published: 2025-09-17T17:50:34.877Z Last Updated: 2025-09-17T18:09:55.732Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: ovh Products: the-bastion Problem Types: CWE-325 Description: The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them
nning, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6 - https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13f
CVE ID: CVE-2025-59340 State: PUBLISHED Published: 2025-09-17T20:01:55.788Z Last Updated: 2025-09-18T15:45:23.121Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HubSpot Products: jinjava Problem Types: CWE-1336 Description: jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a resul
he creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HubSpot/jinjava/security/advisories/GHSA-m49c-g9wr-hv6v - https://github.com/HubSpot/jinjava/commit/66df351e7e8ad71ca04dcacb4b65782af820b8b1 - https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8
ot/jinjava/commit/66df351e7e8ad71ca04dcacb4b65782af820b8b1 - https://github.com/HubSpot/jinjava/releases/tag/jinjava-2.8.1
CVE ID: CVE-2025-59341 State: PUBLISHED Published: 2025-09-17T17:55:25.827Z Last Updated: 2025-09-17T18:09:50.796Z Vendors: esm-dev Products: esm.sh Problem Types: CWE-23 Description: esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r - https://github.com/esm-dev/esm.sh/blob/c62f191d3
s://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r - https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
CVE ID: CVE-2025-59342 State: PUBLISHED Published: 2025-09-17T17:59:34.163Z Last Updated: 2025-09-17T18:20:28.195Z Vendors: esm-dev Products: esm.sh Problem Types: CWE-24 Description: esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Addit
directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw - https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116 - https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411
CVE ID: CVE-2025-59343 State: PUBLISHED Published: 2025-09-24T17:43:34.728Z Last Updated: 2025-11-03T18:13:55.412Z Vendors: mafintosh Products: tar-fs Problem Types: CWE-22, CWE-61 Description: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-
richment: - CVE Program Container: References: - https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v - https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
CVE ID: CVE-2025-59344 State: PUBLISHED Published: 2025-09-19T15:21:19.533Z Last Updated: 2025-09-19T16:08:33.661Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: aliasvault Products: aliasvault Problem Types: CWE-918 Description: AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically fol
"…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public
This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj - https://github.com/aliasvault/aliasvault/pull/1226 - https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968 - https://github.com/aliasvault/aliasvault/releases/tag/0.23.1
CVE ID: CVE-2025-59345 State: PUBLISHED Published: 2025-09-17T19:05:53.441Z Last Updated: 2025-10-13T15:22:12.692Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-306 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting req
1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-89vc-vf32-ch59 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59346 State: PUBLISHED Published: 2025-09-17T19:20:23.153Z Last Updated: 2025-09-17T19:31:01.954Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-918 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to them. The issue arises because the Manager API accepts a user-supplied URL when creating a Preheat job with weak validation, peers can trigger other peers to fetch an arbitrary URL through pieceManager.Download
Preheat job with weak validation, peers can trigger other peers to fetch an arbitrary URL through pieceManager.DownloadSource, and internal HTTP clients follow redirects, allowing a request to a malicious server to be redirected to internal services. This can be used to probe or access internal HTTP endpoints. The vulnerability is fixed in version 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-g2rq-jv54-wcpr - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59347 State: PUBLISHED Published: 2025-09-17T19:23:20.557Z Last Updated: 2025-09-17T19:34:06.018Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-295 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat jobs. An adversary performs a network-level Man-in-the-Middle attack, providing invalid data to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity prob
to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity problems. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-98x5-jw98-6c97 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59348 State: PUBLISHED Published: 2025-09-17T19:30:22.841Z Last Updated: 2025-09-17T19:45:03.134Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-457 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vuln
g the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-2qgr-gfvj-qpcr - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59349 State: PUBLISHED Published: 2025-09-17T19:41:03.632Z Last Updated: 2025-09-18T17:35:48.904Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-732 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access permissions. This function does not perform any permission checks when a given directory path already exists. This allows a local attacker to create a directory to be used later by DragonFly2 with broad permissions before DragonFly2 does so, potentially allowing the attacker to tamper with the files. This v
ly2 with broad permissions before DragonFly2 does so, potentially allowing the attacker to tamper with the files. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-8425-8r2f-mrv6 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59350 State: PUBLISHED Published: 2025-09-17T19:43:24.085Z Last Updated: 2025-09-18T17:42:07.237Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-208 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment:
instruction’s execution times. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-c2fc-9q9c-5486 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59351 State: PUBLISHED Published: 2025-09-17T19:46:41.322Z Last Updated: 2025-09-18T17:42:35.283Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-476 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4mhv-8rh3-4ghw - https://github.com/dragonflyoss/dragonfly/blob/main/docs/sec
nflyoss/dragonfly/security/advisories/GHSA-4mhv-8rh3-4ghw - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59352 State: PUBLISHED Published: 2025-09-17T19:50:38.914Z Last Updated: 2025-09-18T17:43:17.540Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-202, CWE-22 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
he peer’s machine.This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-79hx-3fp8-hj66 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59353 State: PUBLISHED Published: 2025-09-17T19:53:36.109Z Last Updated: 2025-09-18T17:44:13.154Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-295, CWE-862 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerabi
te—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-255v-qv84-29p5 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59354 State: PUBLISHED Published: 2025-09-17T19:57:07.374Z Last Updated: 2025-09-18T15:51:14.626Z Vendors: dragonflyoss Products: dragonfly Problem Types: CWE-328 Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hx2h-vjw2-8r54 - https://github.com/dragonflyoss/dra
https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hx2h-vjw2-8r54 - https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
CVE ID: CVE-2025-59358 State: PUBLISHED Published: 2025-09-15T11:34:30.616Z Last Updated: 2025-09-15T11:57:48.343Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-306 Description: The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chaos-mesh/chaos-mesh/pull/4702 - https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeo
ull/4702 - https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
CVE ID: CVE-2025-59359 State: PUBLISHED Published: 2025-09-15T11:40:04.866Z Last Updated: 2025-09-15T11:56:05.616Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-78 Description: The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chaos-mesh/chaos-mesh/pull/4702 - https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover