584 matches found
BIT-NGINX-INGRESS-CONTROLLER-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...
BIT-NGINX-INGRESS-CONTROLLER-2021-25745 Ingress-nginx path can be pointed to service account token file
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default...
BIT-NGINX-INGRESS-CONTROLLER-2021-25746 Ingress-nginx directive injection via annotations
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default configuration, that...
BIT-NGINX-INGRESS-CONTROLLER-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...
BIT-NGINX-INGRESS-CONTROLLER-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kms, grpcurl, hugo, configmap-reload, prometheus-beat-exporter, tigera-operator, cosign-fips, caddy, kubeflow-pipelines, flux-kustomize-controller, secrets-store-csi-driver-provider-aws, fulcio, kiam, policy-controller,...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: zot, k3d, syft, k9s, buildkitd, kubescape, newrelic-infrastructure-agent, wolfictl, trivy, podman, kaniko, zarf, skopeo, kubernetes, kots, docker, k3s, cadvisor, skaffold, runc, nerdctl, ctop, grype...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: kubernetes, skaffold, k3d, cadvisor, kots, podman, trivy, zot, nerdctl, newrelic-infrastructure-agent, k9s, ctop, zarf, kaniko, wolfictl, runc, grype, skopeo, kubescape, buildkitd, syft, k3s, docker...
Exploit for Improper Input Validation in Kubernetes Ingress-Nginx
CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...
The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx allows a hacker to execute arbitrary code or increase their privileges.
The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to errors in processing incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase their privileges using the logformat directive...
Arbitrary Code Execution
github.com/kubernetes/ingress-nginx is vulnerable to Arbitrary Code Execution. The vulnerability arises from the library's default lack of proper annotation validation. This deficiency enables an attacker to inject and execute malicious code through the...
Improper Access Control
github.com/kubernetes/ingress-nginx is vulnerable to Improper Access Control. The vulnerability exists because the library does not adequately validate path types. Consequently, an attacker with the ability to create or update ingress objects can utilize directives to evade the sanitization of th...
SUSE CVE-2022-4886
Ingress-nginx path sanitization can be bypassed with logformat directive...
SUSE CVE-2023-5043
Ingress nginx annotation injection causes arbitrary command execution...
The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component in the Kubernetes ingress-nginx cluster allows a attacker to execute arbitrary code or escalate their privileges.
The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component, which handles incoming traffic in the Kubernetes ingress-nginx cluster, is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase...
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...
GHSA-FP9F-44C2-CW27 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
GHSA-5WJ4-WFFQ-3378 Ingress nginx annotation injection causes arbitrary command execution
Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...