GHSA-W54X-XFXG-4GXQ NeuVector process with sensitive arguments lead to leakage

Impact When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example, java -cp /app ... Djavax.net.ssl.trustStorePassword= The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the...

PT-2025-35111

Name of the Vulnerable Software and Affected Versions: NeuVector versions prior to 5.4.6 Description: NeuVector process handling can lead to the leakage of sensitive arguments, such as passwords, within security event logs. The software uses regular expressions to detect and redact sensitive data...

SUSE CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

CVE-2023-44392

Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: neuvector-dbgen, cloud-provider-aws, nri-couchbase, prometheus-alertmanager, trust-manager, grpc-health-probe, kubevela, kubernetes-replicator, ctop, ytt, multus-cni, render-template, trino, spire-server, php-fpmexporter, confluent-common-docker, ghaudit, gcsfuse,...

GHSA-679V-HH23-H5JH vulnerabilities

Vulnerabilities for packages: smarter-device-manager-fips, metrics-server, configmap-reload-fips, kubeflow-katib, kind...

PT-2025-36328

Name of the Vulnerable Software and Affected Versions podman versions 4.0.0 through 5.6.1 Description A vulnerability exists in podman where an attacker can use the kube play command to overwrite host files. This occurs when the kube file contains a Secret or a ConfigMap volume mount, and that...

CVE-2023-32191

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

CVE-2023-32191 rke's credentials are stored in the RKE1 Cluster state ConfigMap

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

rke 安全漏洞

rke is an extremely simple, lightning fast Kubernetes installer open-sourced by Rancher. There is a security vulnerability in rke that stems from credentials being stored in a ConfigMap with information that allows a non-administrative user to be upgraded to administrator...

Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11659 Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke

When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...

Sensitive Information Disclosure

github.com/rancher/rke is vulnerable to Sensitive Information Disclosure. The vulnerability exists due to insecure cluster state storage in a publicly accessible configmap called full-cluster-state inside the kube-system namespace, which allows an attacker without administrative privileges to...

rke's credentials are stored in the RKE1 Cluster state ConfigMap

Impact When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data: -...

PT-2024-4208 · Rancher · Rancher Kubernetes Engine +1

Name of the Vulnerable Software and Affected Versions: Rancher Kubernetes Engine RKE versions prior to 1.4.19 Rancher Kubernetes Engine RKE versions prior to 1.5.10 Rancher versions prior to 2.7.14 Rancher versions prior to 2.8.5 Description: The issue is related to the storage of cluster state i...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: prometheus-mysqld-exporter, pulumi-kubernetes-operator, kubernetes-dashboard-fips, docker-credential-acr-env, cue-fips, fulcio, kube-oidc-proxy, configmap-reload, kubecolor, kubernetes-ingress-defaultbackend, cert-exporter-fips, prometheus-redis-exporter-fips,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, bank-vaults, rclone, vexctl, crossplane-provider-aws-cloudwatchlogs, sops, kubescape, zot, newrelic-infrastructure-agent, grafana-agent-operator, pulumi-kubernetes-operator, stakater-reloader, timestamp-authority,...