CVE-2022-23509 Weave Gitops Run vulnerable to insecure communication

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps...

CVE-2022-23508 GitOps Run allows for Kubernetes workload injection

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses...

CVE-2022-23508 GitOps Run allows for Kubernetes workload injection

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses...

CVE-2022-23508

CVE-2022-23508 affects Weave GitOps (GitOps Run) where a local user/process can access a local S3 bucket used to synchronize files with a Kubernetes cluster. The endpoint lacked security controls, allowing on‑machine actors to view/alter bucket content and inject a workload into the bucket, resul...

CVE-2022-23508 GitOps Run allows for Kubernetes workload injection

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses...

PT-2023-12723 · Weave · Weave Gitops

Name of the Vulnerable Software and Affected Versions: Weave GitOps versions prior to v0.12.0 Description: A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses for synchronizing files that are...

PT-2023-12724 · Weave · Weave Gitops

Name of the Vulnerable Software and Affected Versions: Weave GitOps versions prior to v0.12.0 Description: The communication between GitOps Run and the local S3 bucket is not encrypted, allowing privileged users or processes to tap the local traffic and gain information permitting access to the S...

Weave GitOps 信息泄露漏洞

Weaveworks Weave GitOps is a simple open source developer platform from Weaveworks, UK. Weave GitOps suffers from an information disclosure vulnerability that stems from unencrypted communication between GitOps Run and the local S3 bucket...

Virtuozzo Hybrid Server 7.5 Update 4 (7.5.4-465)

Virtuozzo Hybrid Server 7.5 Update 4 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1160.80.1.vz7.191.4. Vulnerability id: PSBM-142718 Node IP was not set when changing 'vnclisten' in '/etc/libvirt/qemu.conf.' Vulnerability id:...

SUSE-SU-2022:4501-1 Security update for ceph

This update for ceph fixes the following issues: ceph was updated to the Pacific release 16.2.9-536-g41a9f9a5573: + bsc1195359, bsc1200553 rgw: check bucket shard init status in RGWRadosBILogTrimCR + bsc1194131 ceph-volume: honour osddmcryptkeysize option CVE-2021-3979 + bsc1200064, Remove last...

Brave Software: S3 Bucket Takeover : brave-apt

An unclaimed S3 bucket was found on the domain brave.com, which was being used in the installation of brave-browser in Linux distros. An attacker could have taken over the S3 bucket and used it to spread malware or create a fake login page to spoof users. The vulnerability was reported to the...

PT-2022-35117 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the propagation of errors from htab lock bucket to userspace. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

GHSA-RC39-G977-687W Use of unclaimed s3 bucket in tests and examples

Impact People who use some older NLP examples that reference the old S3 bucket. Patches The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the vulnerability mostly being examples and 1 class in the actual code base. Workarounds...

Use of unclaimed s3 bucket in tests and examples

Impact People who use some older NLP examples that reference the old S3 bucket. Patches The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the vulnerability mostly being examples and 1 class in the actual code base. Workarounds...

CVE-2022-36022

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

PT-2022-23121 · Unknown · Deeplearning4J

Name of the Vulnerable Software and Affected Versions: Deeplearning4J versions through 1.0.0-M2.1 Description: The issue affects users of older NLP examples that reference an old S3 bucket. The problem arises from the use of some unclaimed S3 buckets in tests and examples. The estimated number of...

CVE-2022-36022 Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 may use some unclaimed S3 buckets in tests in examples. This is likely affect people who use...

CVE-2022-36022

CVE-2022-36022 affects Deeplearning4J up to version 1.0.0-M2.1, where certain tests and examples (packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests) may reference unclaimed S3 buckets. Root cause: tests and NLP example code referencing old, unowned S3 storage. Report...

Virtuozzo Hybrid Infrastructure 5.3 (5.3.0-130)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover Kubernetes as a Service, storage performance, security, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

Fat Free CRM 输入验证错误漏洞

Fat Free CRM is an open source Ruby on Rails based customer relationship management platform. The platform includes modules for team collaboration, customer management, contact lists, customer tracking and more. Fat Free CRM Prior to version 0.20.1 An input validation error vulnerability exists,...