GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: controller-gen, influx, boring-registry, k9s, aws-load-balancer-controller, kserve-rest-proxy, kuberay-operator, nri-discovery-kubernetes, timoni, openfga, metrics-server, k6, newrelic-nri-statsd, kiali, wave, aws-network-policy-agent, velero, kaf,...

GHSA-679V-HH23-H5JH vulnerabilities

Vulnerabilities for packages: configmap-reload-fips, kubeflow-katib, kind, smarter-device-manager-fips, metrics-server, falco...

PT-2025-36328

Name of the Vulnerable Software and Affected Versions podman versions 4.0.0 through 5.6.1 Description A vulnerability exists in podman where an attacker can use the kube play command to overwrite host files. This occurs when the kube file contains a Secret or a ConfigMap volume mount, and that...

CVE-2023-32191

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

rke 安全漏洞

rke is an extremely simple, lightning fast Kubernetes installer open-sourced by Rancher. There is a security vulnerability in rke that stems from credentials being stored in a ConfigMap with information that allows a non-administrative user to be upgraded to administrator...

Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11659 Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke

When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...

Sensitive Information Disclosure

github.com/rancher/rke is vulnerable to Sensitive Information Disclosure. The vulnerability exists due to insecure cluster state storage in a publicly accessible configmap called full-cluster-state inside the kube-system namespace, which allows an attacker without administrative privileges to...

rke's credentials are stored in the RKE1 Cluster state ConfigMap

Impact When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data: -...

PT-2024-4208 · Rancher · Rancher Kubernetes Engine +1

Name of the Vulnerable Software and Affected Versions: Rancher Kubernetes Engine RKE versions prior to 1.4.19 Rancher Kubernetes Engine RKE versions prior to 1.5.10 Rancher versions prior to 2.7.14 Rancher versions prior to 2.8.5 Description: The issue is related to the storage of cluster state i...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, configmap-reload, wave-fips, nats-server, grafana-agent-operator, trillian-fips, paranoia, cortex-fips, prometheus-postgres-exporter, rekor, hey, rootlesskit, harbor-scanner-trivy-fips, kubernetes-csi-external-provisioner, petname,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, falcosidekick, docker-compose, influx, kpt, kargo, slsa-verifier, boring-registry, k9s, kots, hubble, sonobuoy, grpc-health-probe, conftest, aws-load-balancer-controller, terraform, goreleaser, k3d, memcached-exporter, zot,...

SUSE CVE-2023-32191

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

Sensitive Information Disclosure

laf-client-sdk is vulnerable to Sensitive Information Disclosure. The vulnerability is caused due to directly inserting env variables into the the template while constructing the deployment instance of the app. Sensitive information in the secret and configmap can be read through the k8s envFrom...

CVE-2023-48225 Laf env causes sensitive information disclosure

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

PT-2023-30742 · Laf · Laf

Name of the Vulnerable Software and Affected Versions: Laf versions prior to 1.0.0-beta.13 Description: Laf is a cloud development platform where the control of LAF app environment variables is not strict enough, potentially leading to sensitive information leakage in secret and configmap. This...