OPENSUSE-SU-2024:13370-1 etcd-for-k8s1.26-3.5.9-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.26-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13371-1 etcd-for-k8s1.27-3.5.9-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.27-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability in...

CVE-2024-35195 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-pipelines-visualization-server, superset, checkov, mlflow, airflow, py3-cassandra-medusa, kubeflow-volumes-web-app, confluent-docker-utils, py3-pipenv, az, k8s-sidecar, kubeflow-katib, kubeflow-pipelines, reflex, ggshield, patroni,...

GHSA-9WX4-H78V-VM56 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-pipelines-visualization-server, superset, checkov, mlflow, airflow, py3-cassandra-medusa, kubeflow-volumes-web-app, confluent-docker-utils, py3-pipenv, az, k8s-sidecar, kubeflow-katib, kubeflow-pipelines, reflex, ggshield, patroni,...

TotalCloud Container Security Best Practices

Qualys Container Security CS, an integral part of TotalCloud 2.0, provides a comprehensive view of the security posture of containerized applications. Operationalizing a new technology tool in an enterprise often presents its own challenges. This blog seeks to help the operations team familiarize...

CVE-2024-31391

Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for...

CVE-2024-31391: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for...

GHSA-JJG7-2V4V-X38H vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, kubeflow-pipelines-visualization-server, checkov, kubeflow-volumes-web-app, request-1276, nvidia-nsight-compute-13.2, kubeflow-jupyter-web-app, kubeflow-katib, dask-gateway, az, confluent-docker-utils, py3-cassandra-medusa, kserve, jwt-too...

OS Command Injection

github.com/fluid-cloudnative/fluid is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation within the JuicefsRuntime, allowing an authenticated user with the authority to create or update the K8s CRD Dataset/JuicefsRuntime to execute arbitrary OS commands...

Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

Impact OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to...

GHSA-WX8Q-4GM9-RJ2G Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

Impact OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to...

NamespaceHound: protecting multi-tenant K8s clusters

NamespaceHound is an open-source tool for detecting the risk of potential namespace crossing violations and anonymous access opportunities in multi-tenant clusters...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, vertical-pod-autoscaler, pgpool2exporter-fips, kubernetes-dashboard-metrics-scraper-fips, temporal, metrics-server-fips, gotenberg, gitsign, kaf, tigera-operator, flux, pulumi-kubernetes-operator, kube-logging-logging-operator,...

Design/Logic Flaw

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

CVE-2023-50253 laf logs leak

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

CVE-2023-50253

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

CVE-2023-50253: Exposure of Sensitive Information to an Unauthorized Actor

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

Sensitive Information Disclosure

laf-client-sdk is vulnerable to Sensitive Information Disclosure. The vulnerability is caused due to directly inserting env variables into the the template while constructing the deployment instance of the app. Sensitive information in the secret and configmap can be read through the k8s envFrom...

CVE-2023-48225

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...