CVE-2024-23652 vulnerabilities

Vulnerabilities for packages: kaniko, scorecard, conftest-fips, conftest, guac, trivy, docker, buildkitd, kubescape, zot, skaffold...

CVE-2024-23653 vulnerabilities

Vulnerabilities for packages: kaniko, scorecard, conftest-fips, conftest, guac, trivy, docker, buildkitd, kubescape, zot, skaffold...

CVE-2024-23651 vulnerabilities

Vulnerabilities for packages: kaniko, scorecard, conftest-fips, conftest, guac, trivy, docker, buildkitd, kubescape, zot, skaffold...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: cadvisor, k3s, wolfictl, buildkitd, kaniko, k3d, grype, k9s, podman, syft, zot, kots, zarf, kubescape, docker, ctop, runc, kubernetes, skopeo, skaffold, trivy, newrelic-infrastructure-agent, nerdctl...

CVE-2024-23650 vulnerabilities

Vulnerabilities for packages: guac, docker, buildkitd, kaniko, zot, conftest, skaffold, trivy, scorecard, kubescape...

AZL-35438 CVE-2024-23650 affecting package docker-compose for versions less than 2.27.0-1

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

CVE-2024-23650 vulnerabilities

Vulnerabilities for packages: kaniko, scorecard, conftest-fips, conftest, guac, trivy, docker, buildkitd, kubescape, zot, skaffold...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: podman, wolfictl, k3s, kubernetes, ctop, buildkitd, nerdctl, k9s, k3d, kots, docker, runc, kaniko, grype, zarf, trivy, kubescape, skaffold, cadvisor, skopeo, zot, newrelic-infrastructure-agent, syft...

AZL-35432 CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

RunC Flaws Enable Container Escapes, Granting Attackers Host Access

Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have...

@lobehub/chat vulnerable to unauthorized access to plugins

Description: When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. Proof-of-Concept: Let’s suppose that application has been deployed with following command: sudo docker run -d -p 3210:3210 -...

runc (docker) File Descriptor Leak Privilege Escalation

All versions of runc use exploit/linux/local/runc/cwdprivesc msf undefinedcwdprivesc show actions ...actions... msf undefinedcwdprivesc set ACTION msf undefinedcwdprivesc show options ...show and set options... msf undefinedcwdprivesc run This module requires Metasploit:...

vantage6 has insecure SSH configuration for node and server containers

Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...

GHSA-2WGC-48G2-CJ5W vantage6 has insecure SSH configuration for node and server containers

Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...

CVE-2024-22200

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...

CVE-2024-21653

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not expose...

PYSEC-2024-34

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not expose...

Design/Logic Flaw

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...

Authentication flaw

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not expose...

PYSEC-2024-33

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not expose...