Laf Information Disclosure Vulnerability

Laf is a cloud development platform from labring labs. An information disclosure vulnerability exists in Laf 1.0.0-beta.13 and earlier versions, which stems from a vulnerability that allows an authenticated attacker to obtain sensitive information in the logs of Pods under the same namespace...

PT-2024-13887 · Laf · Laf

Name of the Vulnerable Software and Affected Versions: Laf versions 1.0.0-beta.13 and prior Description: Laf is a cloud development platform that uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, the interface does not verify...

Information Disclosure

github.com/weaveworks/tf-controller is vulnerable to Information Disclosure. A flaw in Weave GitOps Terraform Runners tf-runner allows an authenticated remote attacker to acquire user information in pod logs due to accidentally displaying sensitive data by the victim. The functions tfexec.ShowPla...

GHSA-6HVV-J432-23CV Weave GitOps Terraform Controller Information Disclosure Vulnerability

Impact A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners tf-runner, where sensitive data is inadvertently printed - potentially...

CVE-2023-34236 Information Disclosure Vulnerability in Weave GitOps Terraform Controller

Weave GitOps Terraform Controller aka Weave TF-controller is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This...

Weave GitOps 信息泄露漏洞

Weaveworks Weave GitOps is a simple open source developer platform from Weaveworks UK. An information disclosure vulnerability exists in Weave GitOps Terraform Controller Weave TF-controller v0.14.3 and earlier, v0.15.0-rc.4 and earlier, which originates in Weave GitOps Terraform Runners tf-...

Design/Logic Flaw

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of...

CVE-2022-31098 Weave GitOps leaked cluster credentials into logs on connection errors

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of...

Information Exposure in Kubernetes

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name...

Information Disclosure

github.com/argoproj/argo-cd is vulnerable to information disclosure. Credentials used for accessing the remote Helm OCI repository are leaked to anyone with access to the pod logs via access with appropriate permissions to the Kubernetes control plane or a third party log management system becaus...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-14854

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

CVE-2019-14854

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.2 ose-cluster-kube-controller-manager-operator-container security update

An update for ose-cluster-kube-controller-manager-operator-container is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.1 ose-cluster-kube-apiserver-operator-container security update

An update for ose-cluster-kube-apiserver-operator-container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.2 library-go security update

An update for ose-cluster-kube-apiserver-operator-container and ose-cluster-kube-scheduler-operator-container is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring Syste...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-10213

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-10213

OpenShift Container Platform (versions 4.1–4.2) is affected by CVE-2019-10213: secret data written to pod logs is not sanitized when an operator runs at Debug level or higher, enabling a low-privilege user to read sensitive material from logs. Root cause: unsanitized secrets in logs. Impact: info...