Classified Listing Store & Membership Addon Security Vulnerabilities

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: skaffold, gomplate, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, ko, kaf, metrics-server, terraform-provider-aws, metacontroller, coredns, prometheus-elasticsearch-exporter, terraform-provider-azurerm,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, doppler-kubernetes-operator, jaeger-agent, prometheus-beat-exporter, crossplane-provider-azure, nerdctl, skaffold, spire-server, vexctl, gomplate, k8sgpt, kine, tekton-chains, memcached-exporter, melange, cadvisor, aactl,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, bincapz, opentofu, ko, regclient, k3d, coredns, gptscript, src-fingerprint, kubeadm-bootstrap-controller, go-md2man, ollama, grafana, shfmt, nri-mssql, gitlab-kas, certificate-transparency, nri-mysql, harbor-scanner-trivy, argo-cd, helm,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, prometheus-beat-exporter, jaeger-agent, skaffold, crossplane-provider-azure, docker-credential-gcr, gomplate, k8sgpt, tekton-chains, croc, melange, flux-kustomize-controller, cue, cadvisor, aactl, helm-operator, loki,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, prometheus-beat-exporter, jaeger-agent, skaffold, crossplane-provider-azure, docker-credential-gcr, gomplate, k8sgpt, tekton-chains, croc, melange, flux-kustomize-controller, cue, cadvisor, aactl, helm-operator, loki,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: skaffold, crossplane-provider-azure, gomplate, k8sgpt, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, kaf, k3d, metrics-server, prometheus-alertmanager, metacontroller, coredns,...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, crossplane-provider-azure, nerdctl, spire-server, vexctl, gomplate, tekton-chains, memcached-exporter, melange, flux-kustomize-controller, cadvisor, aactl, opentofu, loki, ko, kaf, actions-runner-controller, nfs-subdir-external-provisioner,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, doppler-kubernetes-operator, jaeger-agent, prometheus-beat-exporter, crossplane-provider-azure, nerdctl, skaffold, spire-server, vexctl, gomplate, k8sgpt, kine, tekton-chains, memcached-exporter, melange, cadvisor, aactl,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, bincapz, opentofu, ko, regclient, k3d, coredns, gptscript, src-fingerprint, kubeadm-bootstrap-controller, go-md2man, ollama, grafana, shfmt, nri-mssql, gitlab-kas, certificate-transparency, nri-mysql, harbor-scanner-trivy, argo-cd, helm,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, prometheus-beat-exporter, jaeger-agent, skaffold, crossplane-provider-azure, docker-credential-gcr, gomplate, k8sgpt, tekton-chains, croc, melange, flux-kustomize-controller, cue, cadvisor, aactl, helm-operator, loki,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: skaffold, crossplane-provider-azure, gomplate, k8sgpt, tekton-chains, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, kaf, k3d, metrics-server, prometheus-alertmanager, metacontroller, coredns,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

GHSA-G82W-58JF-GCXX vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: skaffold, crossplane-provider-azure, gomplate, k8sgpt, tekton-chains, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, kaf, k3d, metrics-server, prometheus-alertmanager, metacontroller, coredns,...

GHSA-2WRH-6PVC-2JM9 vulnerabilities

Vulnerabilities for packages: skaffold, crossplane-provider-azure, gomplate, k8sgpt, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, kaf, k3d, metrics-server, prometheus-alertmanager, metacontroller, coredns,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: skaffold, gomplate, memcached-exporter, flux-kustomize-controller, cue, aactl, opentofu, secrets-store-csi-driver-provider-gcp, ko, kaf, metrics-server, terraform-provider-aws, metacontroller, coredns, prometheus-elasticsearch-exporter, terraform-provider-azurerm,...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, crossplane-provider-azure, nerdctl, spire-server, vexctl, gomplate, tekton-chains, memcached-exporter, melange, flux-kustomize-controller, cadvisor, aactl, opentofu, loki, ko, kaf, actions-runner-controller, nfs-subdir-external-provisioner,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: nvidia-device-plugin, external-dns, kubevela, tctl, terraform, minio, goreleaser, falco, spark-operator, scorecard, prometheus-stackdriver-exporter, dynamic-localpv-provisioner, flux-kustomize-controller, gitlab-pages, kubernetes-csi-node-driver-registrar, dgraph,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, capslock, prometheus-beat-exporter, jaeger-agent, skaffold, crossplane-provider-azure, docker-credential-gcr, gomplate, k8sgpt, tekton-chains, croc, melange, flux-kustomize-controller, cue, cadvisor, aactl, helm-operator, loki,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: capslock, doppler-kubernetes-operator, prometheus-beat-exporter, skaffold, crossplane-provider-azure, nerdctl, vexctl, docker-credential-gcr, gomplate, k8sgpt, kine, yam, memcached-exporter, cue, cadvisor, helm-operator, opentofu, loki,...

CVE-2024-5229

The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5229 Primary Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

BIT-hubble-relay-2024-25630

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue...

CVE-2023-49574

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_job in job_name. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page...

CVE-2023-49575

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious....

CVE-2023-49572

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript...

CVE-2023-49573

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_command_action in action_value. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered.....

CVE-2023-49575 XSS vulnerability in VX Search Enterprise

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious....

CVE-2023-49574 XSS vulnerability in VX Search Enterprise

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_job in job_name. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page...

CVE-2023-49573 XSS vulnerability in VX Search Enterprise

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_command_action in action_value. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered.....

CVE-2023-49572 XSS vulnerability in VX Search Enterprise

A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript...

4BRO Insecure Direct Object Reference / API Information Exposure

...

Stark Industries Solutions: An Iron Hammer in the Cloud

The homepage of Stark Industries Solutions. Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government.....

Apple and Google are taking steps to curb the abuse of location-tracking devices — but what about others?

Since the advent of products like the Tile and Apple AirTag, both used to keep track of easily lost items like wallets, keys and purses, bad actors and criminals have found ways to abuse them. These adversaries can range from criminals just looking to do something illegal for a range of reasons,...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 13, 2024 to May 19, 2024)

Did you know we're running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 107 vulnerabilities disclosed in 82...

(RHSA-2024:3352) Important: Red Hat OpenStack Platform 16.2 (etcd) security update

A highly-available key value store for shared configuration Security Fix(es): Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform (CVE-2024-4438) Incomplete fix for CVE-2021-44716 in OpenStack Platform (CVE-2024-4437) Incomplete fix for CVE-2022-41723 in OpenStack Platform...

CVE-2024-35224

OpenProject is the leading open source project management software. OpenProject utilizes tablesorter inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via {icon} substitution in table header values. This attack requires the permissions "Edit work...

CVE-2024-35224 Stored Cross-Site Scripting (XSS) in OpenProject

OpenProject is the leading open source project management software. OpenProject utilizes tablesorter inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via {icon} substitution in table header values. This attack requires the permissions "Edit work...

Go-Secdump - Tool To Remotely Dump Secrets From The Windows Registry

Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to communicate with the Windows...

ShrinkLocker: Turning BitLocker into ransomware

Introduction Attackers always find creative ways to bypass defensive features and accomplish their goals. This can be done with packers, crypters, and code obfuscation. However, one of the best ways of evading detection, as well as maximizing compatibility, is to use the operating system's own...

CVE-2021-47465

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on...