276 matches found
GHSA-5WJ4-WFFQ-3378 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
GHSA-5WJ4-WFFQ-3378 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
GHSA-FP9F-44C2-CW27 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
CVE-2023-5044 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
CVE-2023-5044 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...
CVE-2023-5043 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
CVE-2023-5043 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
Ingress NGINX Controller Injection Vulnerability
Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller. An attacker can exploit this vulnerability to execute arbitrary commands...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: atlantis, k3d, kubeflow-katib, prometheus-blackbox-exporter, gke-gcloud-auth-plugin, kubernetes-csi-livenessprobe, aactl, terraform-provider-azurerm, kots, pulumi, prometheus-adapter, ollama, buildkitd, pulumi-language-yaml, kubescape, memcached-exporter, minio, hey,...
CVE-2023-44487 vulnerabilities
Vulnerabilities for packages: atlantis, k3d, kubeflow-katib, prometheus-blackbox-exporter, gke-gcloud-auth-plugin, kubernetes-csi-livenessprobe, aactl, terraform-provider-azurerm, kots, pulumi, prometheus-adapter, ollama, buildkitd, pulumi-language-yaml, kubescape, memcached-exporter, minio, hey,...
CVE-2021-25748
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...
K14631834: NGINX Controller vulnerability CVE-2020-5863
Security Advisory Description In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other...
K45263486: NGINX Controller vulnerability CVE-2021-23020
Security Advisory Description The NAAS API keys are generated using an insecure pseudo-random string and hashing algorithm, which may lead to predictable keys. CVE-2021-23020 Impact Local attackers are able to potentially generate a valid user key. Security Advisory Status F5 Product Development...
K27205552: NGINX Controller vulnerability CVE-2020-5864
Security Advisory Description Communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. CVE-2020-5864 Impact This vulnerability enables a man-in-the-middle MITM attack that can intercept the communication channel and read/modify data in transit. Security...
K59209532: NGINX Controller NATS vulnerability CVE-2020-5910
Security Advisory Description The Neural Autonomic Transport System NATS messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized. CVE-2020-5910 Impact A malicious user with access to the host where NGINX...
K84084843: NGINX Controller installer vulnerability CVE-2020-5911
Security Advisory Description The NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system. CVE-2020-5911 Impact A man-in-the-middle MITM attacker can use this vulnerability to intercept the insecure HTTP channel and convincingly forge...
K95120415: NGINX Controller AVRD vulnerability CVE-2020-5895
Security Advisory Description AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed messages to the...
K25434422: NGINX Controller vulnerability CVE-2020-5899
Security Advisory Description Recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of...
K43520321: NGINX Controller API Vulnerability CVE-2020-5901
Security Advisory Description Undisclosed API endpoints may allow for a reflected Cross Site Scripting XSS attack. If the victim user is logged in as admin this could result in a complete compromise of the system. CVE-2020-5901 Impact For the attack to occur, a user must visit a specially crafted...
K11922628: NGINX Controller sensitive command-line arguments vulnerability CVE-2020-5866
Security Advisory Description The helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments. CVE-2020-5866 Impact The affected script causes sensitive items to display in the system process listing ps , top while the helper.s...