GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: kaf, task, petname, protoc-gen-go, go-licenses, fulcio, crossplane-provider-azure-managedidentity, croc, slsa-verifier, cluster-proportional-autoscaler, helm-push, go-bindata, kubernetes-dashboard-web, kapp, sqlexporter, cert-manager-webhook-pdns,...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-24375

The CVE-2025-24375 entry concerns the Charmed MySQL K8s operator (and machine operator) with credential leakage risk. Root cause: the operator calls the mysql-shell/DDL scripts by writing a temporary script file containing full URIs with user credentials, created with read permissions (0644); unp...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-24375

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-24375: Plaintext Storage of a Password

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2024-53349

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...

CVE-2024-53349: Improper Privilege Management

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...

CVE-2024-53349

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...

MAL-2025-2348 Malicious code in k8s-deploy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84c86c15f129692c3b73b16951c9f12754789e3a5ea36e3e5d517e05c7e0231b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: kaf, certificate-transparency, petname, go-licenses, croc, slsa-verifier, helm-push, go-bindata, kubernetes-dashboard-web, kapp, sqlexporter, cert-manager-webhook-pdns, vertical-pod-autoscaler, sonobuoy, kpt, falco-exporter, neuvector-sigstore-interface,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: prometheus-operator, gosu, kaf, vexctl, php-fpmexporter, task, kubebuilder, petname, supercronic, docker-credential-acr-env, go-licenses, spark-operator, cni-plugins, crossplane-provider-azure, kubevela, slsa-verifier, cluster-proportional-autoscaler, grafana-operato...

GHSA-RPMJ-RPGJ-QMPM vulnerabilities

Vulnerabilities for packages: rustup, linkerd-extension-init, nushell, linkerd2, berg, zed, lychee, sccache, sdp-k8s-injector...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: vault, k8ssandra-client-fips, packer, calico, scorecard, yunikorn-web, cfssl-fips, hivemind, nvidia-nsight-compute-13.0, consul, elvish, k8s-device-plugin, nri-cassandra, yq, metrics-server-fips, flux-source-controller, gosu, aactl, kapp, delve, cilium-envoy-fips,...

CVE-2024-11274

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274: URL Redirection to Untrusted Site

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: authservice, prometheus-operator, nsc, kaf, vexctl, task, crossplane-provider-aws-firehose, certificate-transparency, osv-scanner, kargo, bank-vaults, crossplane-provider-aws-kms, docker-credential-acr-env, flannel, fulcio, go-licenses, policy-controller,...