251 matches found
SQL Injection in Cloud Native Computing Foundation Harbor
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...
CVE-2021-31232
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
CVE-2021-31232
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
CVE-2021-31232
The CVE-2021-31232 issue affects Cortex’s Alertmanager before version 1.8.1. Root cause: when -experimental.alertmanager.enable-api is enabled, the HTTP basic auth password_file can be used as an attack vector to leak any file content via a webhook, and Alertmanager templates can load any text fi...
CVE-2021-31232
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
CVE-2021-31232: Undefined Security Weakness
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
Exploit for Off-by-one Error in Sudo_Project Sudo
CVE-2021-3156 Note: These instructions are my own and not...
[SECURITY] Fedora 33 Update: nats-server-2.1.9-1.fc33
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...
How to easily protect any Kubernetes application?
The king of container orchestration needs the best security companion: Wallarm WAF. When it comes to speed, portability, and the advantages of microservices architecture, no other product can compete with Kubernetes as a container orchestrator. Nevertheless, even the best solutions have challenge...
How to easily protect any Kubernetes application?
The king of container orchestration needs the best security companion: Wallarm WAF. When it comes to speed, portability, and the advantages of microservices architecture, no other product can compete with Kubernetes as a container orchestrator. Nevertheless, even the best solutions have challenge...
CVE-2020-8660
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed not recognized as a TLS client by a client using only TLS 1.3. Because TLS extensions SNI, ALPN were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some...
CVE-2020-8660
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed not recognized as a TLS client by a client using only TLS 1.3. Because TLS extensions SNI, ALPN were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some...
Design/Logic Flaw
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed not recognized as a TLS client by a client using only TLS 1.3. Because TLS extensions SNI, ALPN were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some...
CVE-2020-8659
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small i.e. 1 byte chunks...
CVE-2020-8664
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret e.g. trusted CA across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even thoug...
CVE-2020-8661
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests...
CVE-2020-8664
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret e.g. trusted CA across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even thoug...
CVE-2020-8661
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests...