EUVD-2025-34634

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58120

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58120

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58120 BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58120

CVE-2025-58120 affects BIG-IP Next SPK, CNF, and Kubernetes (2.x branches). When HTTP/2 Ingress is configured, undisclosed traffic can trigger a NULL pointer dereference in the Traffic Management Microkernel (TMM), causing termination and a denial-of-service condition. Vulnerable known versions i...

F5 BIG-IP Next SPK 代码问题漏洞

F5 BIG-IP Next SPK is a cloud-native application traffic management solution from F5 USA. A code issue vulnerability exists in F5 BIG-IP Next SPK, which stems from the possibility that undisclosed traffic in an HTTP/2 Ingress configuration could lead to the termination of the Traffic Management...

CVE-2025-59303

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress...

Incomplete Filtering of Special Elements

Overview Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements in the config-snippets feature flag. An attacker can access sensitive environment variables, including the Kubernetes service account token secret, by injecting arbitrary HAProxy directives. Note...

CVE-2025-59303

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress...

PT-2025-41287

Name of the Vulnerable Software and Affected Versions HAProxy Kubernetes Ingress Controller versions prior to 3.1.13 HAProxy Enterprise Kubernetes Ingress Controller versions prior to 3.0.16-ee1 HAProxy Enterprise Kubernetes Ingress Controller versions prior to 1.11.13-ee1 HAProxy Enterprise...

EUVD-2025-33296

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress...

HAProxy Kubernetes Ingress Controller 安全漏洞

HAProxy Kubernetes Ingress Controller is a reverse proxy and load balancing tool from US-based HAProxy Inc. A security vulnerability exists in HAProxy Kubernetes Ingress Controller versions prior to 3.1.13, which stems from the configuration snippet feature accepting a configuration snippet from ...

CVE-2025-59303

HAProxy Kubernetes Ingress Controller (before 3.1.13) is vulnerable when the config-snippets feature flag is enabled: it can accept user-provided config snippets from users with create/update permissions, potentially leaking an ingress token secret. Fixed versions are HAProxy Kubernetes Ingress C...

CVE-2025-59303

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress...

Cross-site Scripting (XSS)

Overview double-take is an Unified UI and API for processing and training images for facial recognition Affected versions of this package are vulnerable to Cross-site Scripting XSS via the app.use function in the API component when processing the X-Ingress-Path argument. An attacker can inject an...

EUVD-2025-32704

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...

CVE-2025-11360

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...

CVE-2025-11360

CVE-2025-11360 affects jakowenko double-take up to 1.13.1, specifically the API component (api/src/app.js). The vulnerability arises from manipulating the X-Ingress-Path in app.use, enabling cross-site scripting that can be exploited remotely. A fix is available in version 1.13.2; the patch is id...

CVE-2025-11360 jakowenko double-take API app.js app.use cross site scripting

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...

CVE-2025-11360 jakowenko double-take API app.js app.use cross site scripting

A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...