GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: cluster-api, dcgm-exporter, tailscale, timestamp-authority, crossplane-function-environment-configs-fips, azure-service-operator-fips, configmap-reload, nri-postgresql-fips, kyverno-policy-reporter, chaos-mesh-fips, longhorn-cli, librechat, mcp-grafana-fips,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: tempo, flux-source-controller, kubescape, oauth2-proxy, ko, wireguard-go, cert-exporter, kubernetes-ingress-defaultbackend, spegel, kubecolor, prometheus-alertmanager, kaf, kafkaexporter, spqr, helm-push, cloudflared, timoni, src, crossplane-provider-aws, mods,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: hey, configmap-reload, osv-scanner, dgraph, frp, falcosidekick-fips, rekor-fips, kpt, nfs-subdir-external-provisioner-fips, kubernetes-csi-external-provisioner, timestamp-authority-fips, step-ca-fips, harbor-registry, dockerize-fips, wave, pulumi-language-dotnet,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: tailscale, hey, timestamp-authority, configmap-reload, kyverno-policy-reporter, chezmoi, node-problem-detector, nri-redis, cni-plugins, osv-scanner, dgraph, slsa-verifier, neuvector-dbgen-fips, frp, falcosidekick-fips, prometheus-operator-fips, rekor-fips, kpt,...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

Exposed Endpoints

github.com/kubernetes/ingress-nginx is uses publicly exposed endpoints. The prometheus metrics and healthz of the Kubernetes defaultbackend can be accessed by a remote attacker using a port-forward request to access the publicly accessible metrics...