SUSE CVE-2025-53884

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack offline attack where hashes of known passwords are precomputed...

SUSE CVE-2025-54467

When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log...

GHSA-4VQ8-7JFC-9CVP vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy-fips, rancher-machine, portieris, harbor-fips, gitlab-rails-ce-fips, ctop, docker-credential-gcr-fips, undock, kubeflow-katib, amazon-cloudwatch-agent-operator, cluster-api-helm-controller-fips, harbor, k3d, redpanda, portieris-fips, kyverno,...

CVE-2023-30517

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server...

CVE-2022-43434

Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...

CVE-2019-19747

NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password provided that the active directo...

CVE-2019-10430

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2023-32188

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

CVE-2023-32188 vulnerabilities

Vulnerabilities for packages: neuvector-controller...

CVE-2023-32188

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

CVE-2023-32188 vulnerabilities

Vulnerabilities for packages: neuvector-controller...

CVE-2023-32188 JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

CVE-2023-32188 JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

NeuVector 安全漏洞

NeuVector is an end-to-end container security platform from US-based NeuVector. The platform includes features such as image vulnerability management, access control and container process/filesystem protection. A security vulnerability exists in previous versions of NeuVector...

GO-2024-3201 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector

JWT token compromise can allow malicious actions including Remote Code Execution RCE in github.com/neuvector/neuvector...

GHSA-JFVP-7X6P-H2PV vulnerabilities

Vulnerabilities for packages: k3s, k8s-device-plugin, opentelemetry-collector-contrib, docker, cadvisor, kubernetes, neuvector-scanner, syft, podman, ctop, buildah, grafana-alloy, grype, runc...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: k3s, k8s-device-plugin, opentelemetry-collector-contrib, docker, cadvisor, kubernetes, neuvector-scanner, syft, podman, ctop, buildah, grafana-alloy, grype, runc...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: rancher-fleet, loki-fips, istio-pilot-discovery, harbor, helm-push, tkn, buildkitd, istio-pilot-agent, melange, timoni, tekton-chains, bom, trivy-fips, policy-controller-fips, kots, up, cert-manager-cmctl, eksctl, helm, paranoia, cosign-fips, docker-credential-gcr,...

Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...

GHSA-PH87-4X2G-6HP4 Jenkins NeuVector Vulnerability Scanner Plugin missing permission check

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...