284 matches found
CVE-2024-45041
CVE-2024-45041 affects the External Secrets Operator. A deployment named default-external-secrets-cert-controller is bound to a ClusterRole that grants Harper access: it can perform get/list on secrets resources and patch/update on validatingwebhookconfigurations. This RBAC configuration can be a...
External Secrets 安全漏洞
External Secrets is a Kubernetes-related application open-sourced by External Secrets. A security vulnerability exists in External Secrets versions prior to 0.10.2, which stems from the ability to retrieve or gain access to all secrets across a cluster by abusing deployed SA tokens for elevated...
CVE-2024-45041: Improper Privilege Management
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...
PT-2024-31392
Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 0.10.2 Description The External Secrets Operator is a Kubernetes operator that integrates external secret management systems. It has a deployment called default-external-secrets-cert-controller, whic...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
External Secrets 安全漏洞
External Secrets is a Kubernetes-related application in the External Secrets open source. A security vulnerability exists in external-secrets version 0.9.16 and earlier, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and eleva...
CVE-2024-36540: Insecure Inherited Permissions
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36540
The external-secrets application (a Kubernetes-related tool) is vulnerable in version 0.9.16 and earlier due to insecure inherited permissions (CWE-277 ). This flaw allows an attacker to access sensitive data and perform privilege escalation by obtaining a service account's token. To remediate th...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
PT-2024-27061 · Unknown · External-Secrets
Name of the Vulnerable Software and Affected Versions: external-secrets version 0.9.16 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For external-secrets version 0.9.1...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: sqlpad, timestamp-authority, k8sgpt, fulcio, tkn, pulumi, flux, policy-controller, zot, terragrunt, rook, goreleaser, ksops, py3-azure-identity, restic, velero, step, spire-server, guac, trivy, zarf, trino, sops, rclone, cosign, argo-events, falcoctl,...
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: hey, regclient, spegel, dex, crossplane-provider-azure, flyte, q, k3d, dex-k8s-authenticator, kubecolor, prometheus-postgres-exporter-fips, wire-go, cass-operator-fips, kustomize, aws-flb-cloudwatch-fips, cue-fips, k8sgpt, gops, capslock, kpt,...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: timestamp-authority, caddy, fulcio, tkn, melange, gomplate, minio, policy-controller, zot, terragrunt, rook, skaffold, goreleaser, kargo, kubernetes-dashboard, step, spire-server, guac, zarf, oauth2-proxy, slsa-verifier, sops, cosign, falcoctl, frp, ko,...
CVE-2024-28122 vulnerabilities
Vulnerabilities for packages: spire-server, boring-registry, falcoctl-fips, minio, spire-server-fips, external-secrets-fips, mc-fips, minio-fips, mc, boring-registry-fips, falcoctl...
GHSA-HJ3V-M684-V259 vulnerabilities
Vulnerabilities for packages: spire-server, boring-registry, falcoctl-fips, minio, spire-server-fips, external-secrets-fips, mc-fips, minio-fips, mc, boring-registry-fips, falcoctl...