Dell PowerPath Management Appliance: Operating System Command Injection Vulnerability

The Dell PowerPath Management Appliance is a PowerPath host management application from Dell Inc. that offers two models: a virtual machine-based appliance and a Docker containerized appliance. A command injection vulnerability exists in Dell PowerPath Management Appliance versions 3.3, 3.2, 3.1,...

Dell PowerPath Management Appliance security vulnerabilities

The Dell PowerPath Management Appliance is a PowerPath host management application from Dell Inc. that offers two models: a virtual machine-based appliance and a Docker containerized appliance. An elevation of privilege vulnerability exists in Dell PowerPath Management Appliance version 3.3, whic...

CVE-2022-41939

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

Code injection

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

CVE-2022-41939: Exposure of Sensitive Information to an Unauthorized Actor

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

CVE-2022-41939 Credential exposure when running third-party builders in knative/func

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

Func information leakage vulnerability

Func is Knative open source a client library and CLI that supports the development and deployment of features. An information disclosure vulnerability exists in Func version 1.8.0 and earlier versions. An attacker exploited the vulnerability to cause registry credentials or local docker to be...

CVE-2022-41939

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious "lifecycle" container. This issues has...

CVE-2022-41939

CVE-2022-41939 affects knative.dev/func (client library/CLI for Knative functions). The root issue is credential exposure when using third-party function buildpacks, where a compromised buildpack could expose registry credentials or the local Docker socket to a malicious lifecycle container. The ...

Exploit for Improper Input Validation in Imagemagick

Container Escape Exploit This is a container escape exploit t...

SUSE SLES12 Security Update : python-Werkzeug (SUSE-SU-2022:3977-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3977-1 advisory. - CVE-2019-14806: Fixed insufficient debugger PIN randomness when running the development server in Docker containers bsc1145383. Tenable ha...

Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin

CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt. In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authenticatio...

GHSA-V535-PC6R-77QH Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin

CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt. In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authenticatio...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.6 / 2.361.3.4 Multiple Vulnerabilities (CloudBees Security Advisory 2022-11-15)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.6 or 2.x prior to 2.361.3.4. It is, therefore, affected by multiple vulnerabilities including the following: - CVE-2022-38751 on snakeyaml fixed train 2.346.x.0.z BEE-237...

CVE-2022-45385

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...

Design/Logic Flaw

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2022-45402 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2022-45402 Source advisory:...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2022-45402 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2022-45402 Source advisory: OSV:GHSA-RG94-84XJ-7GQ3...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2022-45402 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2022-45402 Source advisory: OSV:PYSEC-2022-42984...

SUSE-SU-2022:3977-1 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: - CVE-2019-14806: Fixed insufficient debugger PIN randomness when running the development server in Docker containers bsc1145383...