BIG-IP AFM & PEM Security Vulnerabilities

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, goreleaser, skaffold, tctl, aactl, metrics-server, mc, sigstore-scaffolding, kpt, atlantis, kind, prometheus-stackdriver-exporter, oauth2-proxy, haproxy-ingress, slsa-verifier, nodetaint, cilium-envoy, kubeflow-katib, keda, argo-cd,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: vault-k8s, kube-bench, newrelic-nri-kube-events, crossplane-provider-aws, kube-fluentd-operator, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, spicedb, trust-manager, cadvisor, datadog-agent, goreleaser, restic, kargo, skaffold, loki, tctl,....

CVE-2024-3177 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, local-static-provisioner, nodetaint, kubernetes, aws-ebs-csi-driver, node-feature-discovery, cluster-autoscaler, ip-masq-agent, spark-operator, calico,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, metrics-server, postgres-operator, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller, secrets-store-csi-driver-provider-aws,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, temporal-server, metrics-server, postgres-operator, nuclei, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: vault-k8s, mods, kube-bench, crossplane-provider-aws, smarter-device-manager, node-feature-discovery, prometheus-alertmanager, spicedb, trust-manager, cadvisor, direnv, skaffold, loki, src-fingerprint, external-secrets-operator, aactl, nats-server, falcoctl,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: vault-k8s, mods, kube-bench, crossplane-provider-aws, smarter-device-manager, node-feature-discovery, prometheus-alertmanager, spicedb, trust-manager, cadvisor, direnv, skaffold, loki, src-fingerprint, external-secrets-operator, aactl, nats-server, falcoctl,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: configmap-reload, cass-operator, gke-gcloud-auth-plugin, helm-push, smarter-device-manager, gobuster, ip-masq-agent, sops, oras, sbom-scorecard, protoc-gen-go-grpc, vertical-pod-autoscaler, goreleaser, nri-discovery-kubernetes, aactl, docker-cli, grpcurl, cortex,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: vault-k8s, kube-bench, newrelic-nri-kube-events, crossplane-provider-aws, kube-fluentd-operator, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, spicedb, trust-manager, cadvisor, datadog-agent, goreleaser, restic, kargo, skaffold, loki, tctl,....

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, aws-ebs-csi-driver, prometheus-adapter, cluster-autoscaler, ip-masq-agent, spark-operator, calico,...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, aws-ebs-csi-driver, prometheus-adapter, cluster-autoscaler, ip-masq-agent, spark-operator, calico,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, temporal-server, metrics-server, postgres-operator, nuclei, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: vault-k8s, mods, kube-bench, crossplane-provider-aws, smarter-device-manager, node-feature-discovery, prometheus-alertmanager, spicedb, trust-manager, cadvisor, direnv, skaffold, loki, src-fingerprint, external-secrets-operator, aactl, nats-server, falcoctl,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, metrics-server, postgres-operator, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller, secrets-store-csi-driver-provider-aws,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, metrics-server, postgres-operator, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller, secrets-store-csi-driver-provider-aws,...

GHSA-5F94-VHJQ-RPG8 vulnerabilities

Vulnerabilities for packages: configmap-reload, cass-operator, gke-gcloud-auth-plugin, helm-push, smarter-device-manager, gobuster, ip-masq-agent, sops, oras, sbom-scorecard, protoc-gen-go-grpc, vertical-pod-autoscaler, goreleaser, nri-discovery-kubernetes, aactl, docker-cli, grpcurl, cortex,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: configmap-reload, cass-operator, gke-gcloud-auth-plugin, helm-push, smarter-device-manager, gobuster, ip-masq-agent, sops, oras, sbom-scorecard, protoc-gen-go-grpc, vertical-pod-autoscaler, goreleaser, nri-discovery-kubernetes, aactl, docker-cli, grpcurl, cortex,...

CVE-2023-39326 vulnerabilities

Vulnerabilities for packages: configmap-reload, cass-operator, gke-gcloud-auth-plugin, helm-push, smarter-device-manager, gobuster, ip-masq-agent, sops, oras, sbom-scorecard, protoc-gen-go-grpc, vertical-pod-autoscaler, goreleaser, nri-discovery-kubernetes, aactl, docker-cli, grpcurl, cortex,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, goreleaser, skaffold, tctl, aactl, metrics-server, mc, sigstore-scaffolding, kpt, atlantis, kind, prometheus-stackdriver-exporter, oauth2-proxy, haproxy-ingress, slsa-verifier, nodetaint, cilium-envoy, kubeflow-katib, keda, argo-cd,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: vault-k8s, mods, kube-bench, crossplane-provider-aws, smarter-device-manager, node-feature-discovery, prometheus-alertmanager, spicedb, trust-manager, cadvisor, direnv, skaffold, loki, src-fingerprint, external-secrets-operator, aactl, nats-server, falcoctl,...

GHSA-236W-P7WF-5PH8 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, prometheus-alertmanager, cadvisor, restic, metrics-server, postgres-operator, mc, sigstore-scaffolding, slsa-verifier, gitsign, nsc, govulncheck, kubernetes-dashboard, kubeadm-controlplane-controller, secrets-store-csi-driver-provider-aws,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: fq, vault-k8s, kube-bench, smarter-device-manager, envoy-ratelimit, consul, prometheus-alertmanager, nri-rabbitmq, cadvisor, datadog-agent, direnv, goreleaser, skaffold, loki, tctl, src-fingerprint, nats-server, temporal-server, yam, metrics-server, nri-kafka,...

GHSA-PXHW-596R-RWQ5 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, local-static-provisioner, nodetaint, kubernetes, aws-ebs-csi-driver, node-feature-discovery, cluster-autoscaler, ip-masq-agent, spark-operator, calico,...

Exploit for CVE-2024-30078

CVE-2024-30078 Detection and Command Execution Script This...

Exploit for Deserialization of Untrusted Data in Clear Clearml

ClearML Exploit Script This repository contains a Python...

Exploit for Path Traversal in Solarwinds Serv-U

CVE-2024-28995 PoC and Bulk Scanner Overview This...

CVE-2024-6003

A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the...

CVE-2024-6003

A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the...

CVE-2024-6003 Guangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injection

A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the...

resource-agents bug fix update

An update is available for resource-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The resource-agents packages provide the Pacemaker and RGManager...

Moderate: traceroute security update

The traceroute utility displays the route used by IP packets on their way to a specified network (or Internet) host. Security Fix(es): traceroute: improper command line parsing (CVE-2023-46316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and...

Important: bind and dhcp security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. The...

traceroute security update

An update is available for traceroute. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The traceroute utility displays the route used by IP packets on their way....

bind and dhcp security update

An update is available for dhcp, bind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain (BIND) is an implementation of the...

SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2019-1)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2019-1 advisory. The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes. The following...

How we can separate botnets from the malware operations that rely on them

As I covered in last week's newsletter, law enforcement agencies from around the globe have been touting recent botnet disruptions affecting the likes of some of the largest threat actors and malware families. Operation Endgame, which Europol touted as the "largest ever operation against botnets,"....

Cyberattack on Swedish Gambling Site During Eurovision Highlights Strategic Threats

Every year, the Eurovision Song Contest captivates millions of viewers across Europe and beyond, turning a simple music competition into a cultural phenomenon. This popularity extends to various forms of betting, with numerous gambling sites offering odds on Eurovision outcomes. Eurovision has...

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 3, 2024 to June 9, 2024)

_ Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? __Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the...

CVE-2024-37164

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a...

CVE-2024-37164

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a...

CVE-2024-37164

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a...