BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

BIT-KUSTOMIZE-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interv...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: doppler-kubernetes-operator, prometheus-redis-exporter, restic, dex, terraform, grafana-operator, kubernetes-csi-external-resizer, kube-bench, prometheus-beat-exporter-fips, terraform-provider-azurerm, timoni, cilium-cli, falcosidekick, goreleaser,...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: k8sgpt, k9s, helm-operator, flux-helm-controller, up, zarf, kubescape, flux-source-controller, kots, helm-push, kubevela, cilium-cli, eksctl, chartmuseum, zot, trivy...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: kubescape, zarf, trivy, helm-push, cilium-cli, flux-helm-controller, helm-operator, k8sgpt, kubevela, chartmuseum, up, flux-source-controller, eksctl, k9s, kots, zot...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: k8sgpt, k9s, helm-operator, flux-helm-controller, up, zarf, kubescape, flux-source-controller, kots, helm-push, kubevela, cilium-cli, eksctl, chartmuseum, zot, trivy...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: k3d, k9s, falcoctl-fips, gitsign, zarf, cosign-fips, flux, policy-controller-fips, k3s, kubevela, buildkitd, eksctl, kubeflow-katib, vexctl, skopeo, guac, crane, helm-fips, kpt, flux-helm-controller, skaffold, kubescape, nerdctl, bom, ko-fips, aactl, falcoctl, dagger...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: k3d, k9s, falcoctl-fips, gitsign, zarf, cosign-fips, flux, policy-controller-fips, k3s, kubevela, buildkitd, eksctl, kubeflow-katib, vexctl, skopeo, guac, crane, helm-fips, kpt, flux-helm-controller, skaffold, kubescape, nerdctl, bom, ko-fips, aactl, falcoctl, dagger...

CVE-2023-49569 vulnerabilities

Vulnerabilities for packages: goreleaser, pulumi-kubernetes-operator, gitsign, gitness, src-fingerprint, bom, scorecard, go-licenses, nuclei...

GHSA-449P-3H89-PW88 vulnerabilities

Vulnerabilities for packages: goreleaser, pulumi-kubernetes-operator, gitsign, gitness, src-fingerprint, bom, scorecard, go-licenses, nuclei...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, falcoctl-fips, pulumi-kubernetes-operator, crossplane-provider-aws-memorydb, gitsign, crossplane-provider-aws-cloudformation, gitness, cosign-fips, flux, zarf, pulumi-language-java, kubevela, crossplane-provider-aws-eks,...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: kubeflow-fips, step, gitness, dex-k8s-authenticator, amass, haproxy-ingress, kubeflow-katib, prometheus-stackdriver-exporter, cloudflared, ferretdb, kube-state-metrics-fips, nsc, src-fingerprint, prometheus-adapter-fips, libssh2, fulcio-fips, dex, cortex,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, melange, snyk-cli, argo-events-fips, flux-notification-controller, task, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events, melange, flux-notification-controller, pulumi-kubernetes-operator, task, argo-workflows, snyk-cli...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, melange, snyk-cli, argo-events-fips, flux-notification-controller, task, argo-events...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: policy-controller, tekton-chains, ko, falcoctl-fips, spire-server-fips, skaffold, kubescape, flux-source-controller, melange, cosign, tkn, spire-server, apko, aactl, slsa-verifier...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: policy-controller, tekton-chains, ko, falcoctl-fips, spire-server-fips, skaffold, kubescape, flux-source-controller, melange, cosign, tkn, spire-server, apko, aactl, slsa-verifier...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: k3d, paranoia, tekton-chains, falcoctl-fips, ctop, spire-server-fips, rancher-agent, skaffold, kubescape, up, k3s, bom, scorecard, chartmuseum, aactl, slsa-verifier, kpt...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: k3d, kubernetes-csi-livenessprobe-fips, falcoctl-fips, dgraph, kubeflow-fips, terraform-provider-sendgrid-fips, kubevela, buildkitd, prometheus-stackdriver-exporter, bank-vaults-fips, prometheus-adapter-fips, conftest-fips, cortex, kubescape, kubeflow, aactl,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, kubescape, buildkitd, dgraph, spark-operator, src, kubevela, prometheus-blackbox-exporter, scorecard, up, kubeflow, slsa-verifier, terraform-provider-sendgrid, cortex, k3d...