GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: minio, wave, opentelemetry-collector-contrib-fips, docker-credential-acr-env-fips, maru, seaweedfs-operator-fips, kubo, amass, blobfuse2-fips, bank-vaults-fips, google-guest-agent, wavefront-collector-for-kubernetes, boring-registry, coredns, yace,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: helm-push, ip-masq-agent, grafana-operator, mkcert, prometheus-adapter, pulumi-language-dotnet, metrics-server, delve, gomplate, glab, dex, hey, configmap-reload, kube-state-metrics, spicedb, src-fingerprint, k8sgpt, pombump, vt-cli, kaf, scorecard, kustomize,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: wave, opentelemetry-collector-contrib-fips, zot, wavefront-collector-for-kubernetes, helm-operator-fips, bank-vaults-fips, boring-registry, nats-server, kube-bench-fips, helm-push, kustomize, kube-oidc-proxy, local-path-provisioner, argo-workflows-fips, falcoctl,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: wave, amass, helm-operator-fips, bank-vaults-fips, wavefront-collector-for-kubernetes, boring-registry, nats-server, kube-bench-fips, harbor, terraform, cni-plugins-fips, helm-push, kustomize, ollama, kube-oidc-proxy, local-path-provisioner, nsc, argo-workflows-fips,...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

Exposed Endpoints

github.com/kubernetes/ingress-nginx is uses publicly exposed endpoints. The prometheus metrics and healthz of the Kubernetes defaultbackend can be accessed by a remote attacker using a port-forward request to access the publicly accessible metrics...