GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, mig-parted-fips, rancher-helm, stern, aws-network-policy-agent-fips, pgtimetable-fips, knative-net-istio-fips, nfpm, terraform, blobfuse2-fips, step-fips, smokescreen, crossplane-provider-aws-cloudfront, rootlesskit-fips,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws, kpt, ctop, ferretdb, mods, skopeo, neuvector-scanner, prometheus-adapter, influx, step, libnvidia-container, gostatsd, eksctl, kubecolor, skaffold, flux-source-controller, hubble-ui, docker-credential-acr-env, grafana-agent-operator,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: stern, docker-credential-ecr-login, step-fips, guac, multus-cni, oauth2-proxy, cert-exporter-fips, mkcert, atlantis, crossplane-provider-azure, step, sops, prometheus-mysqld-exporter, dive, src-fingerprint, prometheus-statsd-exporter, aws-flb-firehose-fips, mage,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: stern, docker-credential-ecr-login, terraform, step-fips, oauth2-proxy, cert-exporter-fips, k3s, mkcert, atlantis, crossplane-provider-azure, kube-logging-operator, aws-flb-cloudwatch, istio-pilot-agent, kyverno-policy-reporter, minify-fips, step, sops,...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

Exposed Endpoints

github.com/kubernetes/ingress-nginx is uses publicly exposed endpoints. The prometheus metrics and healthz of the Kubernetes defaultbackend can be accessed by a remote attacker using a port-forward request to access the publicly accessible metrics...