PT-2023-22340

Name of the Vulnerable Software and Affected Versions Oliva Expertise EKS versions prior to 1.2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For...

PT-2023-22330

Name of the Vulnerable Software and Affected Versions Oliva Expertise EKS versions prior to 1.2 Description The issue affects Oliva Expertise EKS, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations For versions prior to 1.2, updat...

CVE-2023-2963: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2960: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting XSS. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2959: Authentication Bypass by Primary Weakness

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Oliva Expertise EKS: before 1.2...

Code injection

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

CVE-2023-35165

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages "aws-cdk-lib" 2.0.0 until 2.80.0 and "@aws-cdk/aws-eks" 1.57.0 until 1.202.0, "eks.Cluster" and "eks.FargateCluste...

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

CVE-2023-35165

CVE-2023-35165 concerns the AWS CDK EKS trust policies. In affected releases of aws-cdk-lib (2.0.0–2.80.0) and @aws-cdk/aws-eks (1.57.0–1.202.0), eks.Cluster and eks.FargateCluster create two roles, CreationRole and default MastersRole, with overly permissive trust policies. The CreationRole is u...

CVE-2023-35165: Incorrect Authorization

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

GHSA-RX28-R23P-2QC3 AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @aws-cdk/aws-stepfunctions-tasks (>=1.91.0, <=1.201.0) +30 more potentially affected by CVE-2023-35165 via @aws-cdk/aws-eks (>=1.57.0, <=1.201.0)

@aws-cdk/aws-eks NPM version =1.57.0, =1.0.0, =1.91.0, =1.57.0, =0.12.1, =1.115.0, =1.91.0, =1.91.0, =1.115.0, =0.0.1-beta.1, =0.0.1, =25.1.0, =0.2.0, =0.1.0, =0.3.2 and more Source cves: CVE-2023-35165 Source advisory: OSV:GHSA-RX28-R23P-2QC3...

AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

PT-2023-25176 · Amazon · @Aws-Cdk/Aws-Eks +2

Name of the Vulnerable Software and Affected Versions: aws-cdk-lib versions 2.0.0 through 2.80.0 @aws-cdk/aws-eks versions 1.57.0 through 1.202.0 Description: The issue concerns the AWS Cloud Development Kit AWS CDK, an open-source software development framework. In the affected packages,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: wireguard-go, gke-gcloud-auth-plugin, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kubeflow-fips, grpcurl, kubeflow-katib, hey, go, restic, terraform-provider-sendgrid-fips, kube-state-metrics, kubeflow...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: wireguard-go, gke-gcloud-auth-plugin, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kubeflow-fips, grpcurl, kubeflow-katib, hey, go, restic, terraform-provider-sendgrid-fips, kube-state-metrics, kubeflow...

GHSA-GWC9-M7RH-J2WW vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kubeflow-fips, terraform-provider-sendgrid-fips, kubeflow...

GHSA-69CG-P879-7622 vulnerabilities

Vulnerabilities for packages: wireguard-go, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kubeflow-fips, grpcurl, kubeflow-katib, hey, terraform-provider-sendgrid-fips, kube-state-metrics, kubeflow...

CVE-2022-27664 vulnerabilities

Vulnerabilities for packages: wireguard-go, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kubeflow-fips, grpcurl, kubeflow-katib, hey, terraform-provider-sendgrid-fips, kube-state-metrics, kubeflow...