CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application open-sourced by External Secrets. A security vulnerability exists in External Secrets versions prior to 0.10.2, which stems from the ability to retrieve or gain access to all secrets across a cluster by abusing deployed SA tokens for elevated...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application in the External Secrets open source. A security vulnerability exists in external-secrets version 0.9.16 and earlier, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and eleva...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

The CVE refers to CVE-2024-36540 affecting external-secrets v0.9.16, where insecure permissions in the service account token handling allow an attacker to access sensitive data and escalate privileges. The issue is described across multiple feeds as a root-cause of insecure permissions enabling t...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

PT-2024-27061 · Unknown · External-Secrets

Name of the Vulnerable Software and Affected Versions: external-secrets version 0.9.16 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For external-secrets version 0.9.1...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: flux, spire-server, boring-registry, trino, thanos, tkn, secrets-store-csi-driver-provider-azure, falcoctl, zarf, opentelemetry-collector-contrib, ksops, fluent-bit-plugin-loki, goreleaser, grafana-mimir, rclone, rekor, step-ca, pulumi, flux-kustomize-controller,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: docker-compose, opa, opentelemetry-collector-contrib-fips, frp, cloudflared, kubernetes-dashboard-metrics-scraper, wire-go, smarter-device-manager-fips, volume-modifier-for-k8s, kyverno-policy-reporter-kyverno-plugin, go-licenses, rekor, harbor-registry-fips,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: spire-server, wolfictl, aactl, gitsign, kube-rbac-proxy, falcoctl, zarf, temporal-ui-server, gomplate, vexctl, step-ca, goreleaser, melange, oauth2-proxy, ko, rekor, flux-kustomize-controller, apko, kubescape, sops, zot, argo-workflows, cloudflared, temporal, dex,...

CVE-2024-28122 vulnerabilities

Vulnerabilities for packages: mc, spire-server, boring-registry-fips, minio, falcoctl, boring-registry, external-secrets-fips, falcoctl-fips, mc-fips, minio-fips, spire-server-fips...

GHSA-HJ3V-M684-V259 vulnerabilities

Vulnerabilities for packages: mc, spire-server, boring-registry-fips, minio, falcoctl, boring-registry, external-secrets-fips, falcoctl-fips, mc-fips, minio-fips, spire-server-fips...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: spire-server, boring-registry, gitsign, mc, falcoctl, vexctl, tekton-chains, minio, kubescape...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: vexctl, cosign-fips, gitsign, kubescape, falcoctl, falcoctl-fips, tekton-chains...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: metrics-server-fips, scorecard, terraform-provider-sendgrid, smarter-device-manager-fips, kubeflow-fips, dynamic-localpv-provisioner-fips, up, src, vault-csi-provider, buildkitd, aactl, kubescape, aws-efs-csi-driver-fips, kubevela, terraform-provider-sendgrid-fips,...

SUSE CVE-2019-13509

In Docker CE and EE before 18.09.8 as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10, Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes non external secrets. I...

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10) Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

...

DEBIAN-CVE-2019-13509

In Docker CE and EE before 18.09.8 as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10, Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes non external secrets. I...