Elevating Security: Qualys Unveils First Solution for Scanning AWS Bottlerocket in Amazon EKS and Amazon ECS

With this new offering, Qualys establishes itself as the first and only vendor solution with the unique ability to scan AWS Bottlerocket instances directly using the Qualys Cloud Agent and TotalCloud Agent-less Snapshot-Based Scan. This innovative capability empowers organizations to...

BIT-GITLAB-2020-13261

Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code...

BIT-GITLAB-2020-13318

A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: flux-source-controller, k8sgpt-operator, external-secrets-fips, caddy, crossplane-provider-aws-sqs, flux-helm-controller, certificate-transparency, supercronic, falcoctl-fips, hugo, crossplane-provider-family-aws, crossplane-provider-aws-iam, aws-efs-csi-driver-fips,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: tailscale, k8sgpt-operator, terraform, external-secrets-fips, kpt, minio, prometheus-redis-exporter, nri-nginx, minio-fips, caddy, gke-gcloud-auth-plugin, kind, grafana-operator-fips, jsonnet-bundler, yam, argo-workflows, dgraph, src, k8ssandra-operator,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: flux-source-controller, k8sgpt-operator, external-secrets-fips, caddy, crossplane-provider-aws-sqs, flux-helm-controller, certificate-transparency, supercronic, falcoctl-fips, hugo, crossplane-provider-family-aws, crossplane-provider-aws-iam, aws-efs-csi-driver-fips,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: tailscale, k8sgpt-operator, terraform, external-secrets-fips, kpt, minio, prometheus-redis-exporter, nri-nginx, minio-fips, caddy, gke-gcloud-auth-plugin, kind, grafana-operator-fips, jsonnet-bundler, yam, argo-workflows, dgraph, src, k8ssandra-operator,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, spark-operator, http-echo, nri-haproxy, nri-cassandra, up, actions-runner-controller, gomplate, nri-mysql, prometheus-alertmanager, hello-world-golang, runc, dask-gateway, sonobuoy, kwok, helm-operator, src, k3d, rqlite, cadvisor,...

New attack vectors in EKS

We explore how advancements in EKS Access Entries and Pod Identity have opened new attack vectors and offer examples of how adversaries could exploit them...

New EKS Access Management and Pod Identity features: a security analysis

The Wiz research team unpacks the security implications of the new EKS access and identity management features and recommends best practices when using them...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: plutono-fips, kubevela, aactl, kubernetes-csi-livenessprobe, kubeflow-fips, prometheus-stackdriver-exporter, scorecard, dgraph, src, terraform-provider-sendgrid-fips, up, kubescape, kiam, falcoctl-fips, smarter-device-manager-fips, vault-csi-provider,...

IMDShift - Automates Migration Process Of Workloads To IMDSv2 To Avoid SSRF Attacks

AWS workloads that rely on the metadata endpoint are vulnerable to Server-Side Request Forgery SSRF attacks. IMDShift automates the migration process of all workloads to IMDSv2 with extensive capabilities, which implements enhanced security measures to protect against these attacks. Features...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: flux-source-controller, k8sgpt-operator, terraform, kpt, minio, apko, frp, metacontroller, gke-gcloud-auth-plugin, prometheus-stackdriver-exporter, dgraph, src, falcoctl, flux-helm-controller, bom, aws-efs-csi-driver, aws-ebs-csi-driver, yq, hugo, nri-prometheus, hel...

CVE-2023-2963

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2963

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection.This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2959

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting XSS. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2963

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting XSS. This issue affects Oliva Expertise EKS: before 1.2...

CVE-2023-2959

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2...