BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager Security Vulnerabilities

(Almost) everything you always wanted to know about cybersecurity, but were too afraid to ask, with Tjitske de Vries: Lock and Code S05E13

This week on the Lock and Code podcast… Ready to know what Malwarebytes knows? Ask us your questions and get some answers. What is a passphrase and what makes it—what’s the word? Strong? Every day, countless readers, listeners, posters, and users ask us questions about some of the most commonly...

CVE-2024-6055

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode...

CVE-2024-6055

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode...

CVE-2024-6057

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode...

CVE-2024-6055

Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration...

China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices

A suspected China-nexus cyber espionage actor has been attributed as behind a prolonged attack against an unnamed organization located in East Asia for a period of about three years, with the adversary establishing persistence using legacy F5 BIG-IP appliances and using it as an internal...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: skaffold, k3s, up, cert-manager, falco, k3d, aactl, tekton-pipelines, kpt, bom, ctop, loki, prometheus, goreleaser, slsa-verifier, paranoia, tekton-chains, scorecard, kubescape,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: consul, clusterctl, docker, policy-controller, crossplane, frp, cert-manager, flux-image-reflector-controller, external-secrets-operator, nri-discovery-kubernetes, kube-state-metrics, syft, gomplate, kubernetes-event-exporter, aws-load-balancer-controller,...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: trivy, k9s, up, kots, flux-helm-controller, zarf, eksctl, cilium-cli, cert-manager, helm-push, helm-operator, kubescape, zot, flux-source-controller, istio-operator, chartmuseum,...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: skaffold, flux-source-controller, up, cert-manager, k3d, newrelic-infrastructure-agent, kaniko, trivy, tekton-pipelines, helm-push, ctop, telegraf, fuse-overlayfs-snapshotter, grype, kots, neuvector-agent, helm, cilium-cli, melange, flux-helm-controller, eksctl, zot,.....

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: trivy, k9s, up, kots, flux-helm-controller, zarf, eksctl, cilium-cli, cert-manager, helm-push, helm-operator, kubescape, zot, flux-source-controller, istio-operator, chartmuseum,...

GHSA-X84C-P2G9-RQV9 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy, buf, kaniko, grype, docker, melange, dagger, policy-controller, helm-push, tekton-pipelines, k3d, neuvector-scanner, wolfictl, docker-compose, syft, cri-tools,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: pombump, consul, nri-mssql, clusterctl, crossplane, render-template, vite, flux-image-reflector-controller, nri-discovery-kubernetes, kube-state-metrics, gomplate, kubernetes-event-exporter, aws-load-balancer-controller, newrelic-infrastructure-agent, thanos-operator,....

CVE-2024-0874 vulnerabilities

Vulnerabilities for packages: consul, kubernetes-dns-node-cache,...

GHSA-888H-RM2R-VRC7 vulnerabilities

Vulnerabilities for packages: falco, policy-controller,...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: argo-cd, flux-source-controller, kyverno, cert-manager, external-secrets-operator, falco, rekor, aactl, oauth2-proxy, cloudflared, terragrunt, tekton-pipelines, cosign, spire-server, flux-kustomize-controller, traefik, kots, sops, dex, gitsign, slsa-verifier,...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-cd, flux-notification-controller, melange, argo-workflows,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: frp, cert-manager, gomplate, nginx-stable, newrelic-infrastructure-agent, influxd, opentofu, gatekeeper, nri-prometheus, flux-kustomize-controller, grype, wireguard-go, dex, haproxy-ingress, helm, gitlab-runner, git-lfs, vault-csi-provider, gitlab-shell,...

CVE-2024-3177 vulnerabilities

Vulnerabilities for packages: spark-operator, kubernetes-dns-node-cache, nodetaint, cluster-autoscaler, kubernetes, node-feature-discovery, calico, ip-masq-agent, kubernetes-csi-driver-hostpath, local-static-provisioner,...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: apko, skaffold, flux-source-controller, policy-controller, ko, falco, aactl, falcoctl, zarf, neuvector-sigstore-interface, spire-server, goreleaser, gitsign, slsa-verifier, melange, vexctl, zot, tekton-chains, tkn, wolfictl,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: skaffold, k3s, docker, k3d, nvidia-device-plugin, syft, buildkitd, newrelic-infrastructure-agent, kaniko, trivy, zarf, ctop, telegraf, grype, ingress-nginx-controller, kots, nerdctl, skopeo, runc, cadvisor, k9s, kubernetes, zot, wolfictl, kubescape,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: crossplane, frp, render-template, bincapz, harbor-registry, gomplate, aws-load-balancer-controller, capslock, volume-modifier-for-k8s, ferretdb, nri-mysql, velero-plugin-for-aws, gitsign, caddy, gitlab-shell, guac, q, kubernetes-dashboard,...

GHSA-JJG7-2V4V-X38H vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-pipelines-visualization-server, py3.10-tensorflow-core, confluent-docker-utils, kubeflow-pipelines, dask-gateway, ggshield, jwt-tool, az, k8s-sidecar, py3-cassandra-medusa, kubeflow-volumes-web-app, py3-idna, datadog-agent,...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy, buf, kaniko, grype, docker, melange, dagger, policy-controller, helm-push, tekton-pipelines, k3d, neuvector-scanner, wolfictl, docker-compose, syft, cri-tools,...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: prometheus, gatekeeper, thanos, gitlab-kas, k3s, up, kubernetes, cert-manager, calico, prometheus-adapter, caddy, ipfs, keda,...

GHSA-2HMF-46V7-V6FX vulnerabilities

Vulnerabilities for packages: guac, melange, zot, dagger,...

CVE-2024-30251 vulnerabilities

Vulnerabilities for packages:...

GHSA-5M98-QGG9-WH84 vulnerabilities

Vulnerabilities for packages:...

CVE-2023-29403 vulnerabilities

Vulnerabilities for packages: falco, policy-controller,...

GHSA-F2CJ-5636-4J38 vulnerabilities

Vulnerabilities for packages: falco, policy-controller,...

GHSA-RXX3-4978-3CC9 vulnerabilities

Vulnerabilities for packages: falco, policy-controller,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: pombump, clusterctl, gostatsd, policy-controller, crossplane, frp, cert-manager, render-template, flux-image-reflector-controller, external-secrets-operator, kube-state-metrics, extism, step, harbor-registry, libnvidia-container, gomplate, trivy,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: pombump, clusterctl, gostatsd, policy-controller, crossplane, frp, cert-manager, render-template, flux-image-reflector-controller, external-secrets-operator, kube-state-metrics, extism, step, harbor-registry, libnvidia-container, gomplate, trivy,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: crossplane, frp, render-template, extism, harbor-registry, gomplate, aws-load-balancer-controller, capslock, volume-modifier-for-k8s, ferretdb, nri-mysql, velero-plugin-for-aws, gitsign, caddy, gitlab-shell, q, kubernetes-dashboard,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: prometheus-bind-exporter, go-licenses, render-template, nri-discovery-kubernetes, falco, k3d, hey, kind, aactl, gops, helm-push, docker-cli, ctop, mage, nats, configmap-reload, protoc-gen-go-grpc, smarter-device-manager, aws-flb-cloudwatch, sbom-scorecard,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: consul, frp, flux-image-reflector-controller, external-secrets-operator, kube-state-metrics, gomplate, aws-load-balancer-controller, newrelic-infrastructure-agent, influxd, thanos-operator, nfs-subdir-external-provisioner, opentofu, gatekeeper, nri-prometheus,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: skaffold, k3s, kyverno, up, k8sgpt, policy-controller, cert-manager, flux-image-reflector-controller, falco, istio-pilot-agent, kargo, buildkitd, aactl, newrelic-infrastructure-agent, trivy, falcoctl, tekton-pipelines, zarf, crane, bom, ctop, telegraf, timoni, dagger,....

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: consul, clusterctl, docker, policy-controller, crossplane, frp, cert-manager, flux-image-reflector-controller, external-secrets-operator, nri-discovery-kubernetes, kube-state-metrics, syft, gomplate, kubernetes-event-exporter, aws-load-balancer-controller,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: pombump, consul, nri-mssql, clusterctl, crossplane, render-template, vite, flux-image-reflector-controller, nri-discovery-kubernetes, kube-state-metrics, gomplate, kubernetes-event-exporter, aws-load-balancer-controller, newrelic-infrastructure-agent, thanos-operator,....

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: pombump, consul, nri-mssql, clusterctl, crossplane, render-template, vite, flux-image-reflector-controller, nri-discovery-kubernetes, kube-state-metrics, gomplate, kubernetes-event-exporter, aws-load-balancer-controller, newrelic-infrastructure-agent, thanos-operator,....

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: flyte, grafana-mimir, kyverno, up, policy-controller, cert-manager, step-ca, flux-image-reflector-controller, external-secrets-operator, sqlpad, rekor, step, nuclei, harbor-registry, rook, restic, fluent-bit-plugin-loki, teleport, timestamp-authority, buildkitd,...

GHSA-M5VV-6R4H-3VJ9 vulnerabilities

Vulnerabilities for packages: flyte, grafana-mimir, kyverno, up, policy-controller, cert-manager, step-ca, flux-image-reflector-controller, external-secrets-operator, sqlpad, rekor, step, nuclei, harbor-registry, rook, restic, fluent-bit-plugin-loki, teleport, timestamp-authority, buildkitd,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-cd, flux-notification-controller, melange, argo-workflows,...

CVE-2024-3651 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-pipelines-visualization-server, py3.10-tensorflow-core, confluent-docker-utils, kubeflow-pipelines, dask-gateway, ggshield, jwt-tool, az, k8s-sidecar, py3-cassandra-medusa, kubeflow-volumes-web-app, py3-idna, datadog-agent,...

GHSA-M9W6-WP3H-VQ8G vulnerabilities

Vulnerabilities for packages: consul, kubernetes-dns-node-cache,...

GHSA-H75V-3VVJ-5MFJ vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, pytorch, superset, py3-jinja2, confluent-docker-utils, dask-gateway, reflex,...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: consul, nri-mssql, crossplane, frp, cert-manager, flux-image-reflector-controller, external-secrets-operator, kube-state-metrics, step, gomplate, kubernetes-event-exporter, trivy, influxd, nfs-subdir-external-provisioner, opentofu, prometheus-nats-exporter,...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: prometheus, gatekeeper, thanos, gitlab-kas, k3s, up, kubernetes, cert-manager, calico, prometheus-adapter, caddy, ipfs, keda,...