CVE-2023-48225

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

CVE-2023-48225 Laf env causes sensitive information disclosure

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

Announcing the EKS Cluster Games

Test your investigation skills and K8s knowledge in a new Wiz-sponsored CTF event: the EKS Cluster Games!...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, prometheus-adapter-fips, timestamp-authority-fips, bank-vaults-fips, aws-efs-csi-driver-fips, spark-operator, prometheus-blackbox-exporter, metrics-server-fips, dynamic-localpv-provisioner-fips, slsa-verifier, falcoctl-fips,...

GHSA-MQ26-G339-26XF vulnerabilities

Vulnerabilities for packages: jwt-tool, k8s-sidecar...

CVE-2023-5752 vulnerabilities

Vulnerabilities for packages: jwt-tool, k8s-sidecar...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, kubeflow-katib, nvidia-nsight-compute-13.1, py3-pipenv, jwt-tool, kubeflow-volumes-web-app, k8s-sidecar, az, py3-tensorflow-serving-api, request-1276, nvidia-nsight-compute-13.2...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, kubeflow-katib, nvidia-nsight-compute-13.1, py3-pipenv, jwt-tool, kubeflow-volumes-web-app, k8s-sidecar, az, py3-tensorflow-serving-api, request-1276, nvidia-nsight-compute-13.2...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, yq, dex-k8s-authenticator, vertical-pod-autoscaler, prometheus-blackbox-exporter, metrics-server-fips, kubeflow-katib, falcoctl, kaf, secrets-store-csi-driver, atlantis-fips, flux, pulumi-kubernetes-operator,...

CVE-2023-43804 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-volumes-web-app, k8s-sidecar, py3-urllib3, dask-gateway, kube-downscaler, py3.13-scanner-test-libraries...

GHSA-V845-JXX5-VC9F vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, kubeflow-volumes-web-app, k8s-sidecar, py3-urllib3, dask-gateway, kube-downscaler, py3.13-scanner-test-libraries...

CVE-2023-32681 vulnerabilities

Vulnerabilities for packages: k8s-sidecar...

CVE-2021-25748: Improper Input Validation

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...

GHSA-J8R2-6X86-Q33Q vulnerabilities

Vulnerabilities for packages: k8s-sidecar...

MAL-2023-1424 Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

MAL-2023-546 Malicious code in k8s-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ccbda1c33a268bb1641ff4dc9ed60a84c28d96d167768dc09e6258fb96d697c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Feature Spotlight: Kubernetes Enforcement

Akamai’s new enforcement capabilities for K8s environments provides segmentation for applications and blocks lateral movement to, from, and inside K8s clusters...

Use of Hard-coded Credentials

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

CVE-2023-22463

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

CVE-2023-22463

KubePi (Kubernetes dashboard) vulnerability CVE-2023-22463: The jwt authentication in versions up to 1.6.2 used hard-coded JwtSigKey in session.go, enabling forging of JWTs and unauthorized admin access across projects; attacker could escalate to K8s cluster control. The issue is fixed in 1.6.3, ...