CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

CVE-2024-45041 External Secrets Operator vulnerable to privilege escalation

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application open-sourced by External Secrets. A security vulnerability exists in External Secrets versions prior to 0.10.2, which stems from the ability to retrieve or gain access to all secrets across a cluster by abusing deployed SA tokens for elevated...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application in the External Secrets open source. A security vulnerability exists in external-secrets version 0.9.16 and earlier, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and eleva...

CVE-2024-36540

The CVE refers to CVE-2024-36540 affecting external-secrets v0.9.16, where insecure permissions in the service account token handling allow an attacker to access sensitive data and escalate privileges. The issue is described across multiple feeds as a root-cause of insecure permissions enabling t...

PT-2024-27061 · Unknown · External-Secrets

Name of the Vulnerable Software and Affected Versions: external-secrets version 0.9.16 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For external-secrets version 0.9.1...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-36540

Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: step, boring-registry, hugo-extended, cosign, cortex, grafana-agent-operator, pulumi, zot, thanos, up, opentelemetry-collector-contrib, tkn, tekton-chains, trino, spire-server, wal-g, zarf, sigstore-scaffolding, prometheus-operator, flux-kustomize-controller,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: kpt, flyte, guac, harbor-registry-fips, scorecard, bank-vaults-fips, kyverno-policy-reporter-kyverno-plugin, petname, wavefront-collector-for-kubernetes, vault-k8s-fips, configmap-reload, wgcf, cadvisor, mkcert, kubernetes-dashboard-metrics-scraper-fips,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: step, kube-rbac-proxy, cosign, apko, cloudflared, zot, rabbitmq-messaging-topology-operator, skopeo, tkn, tekton-chains, minio, spire-server, gomplate, kargo, zarf, sigstore-scaffolding, kubernetes-dashboard, flux-kustomize-controller, slsa-verifier, dgraph, weaviate...

CVE-2024-28122 vulnerabilities

Vulnerabilities for packages: mc, spire-server, falcoctl-fips, mc-fips, spire-server-fips, external-secrets-fips, minio-fips, boring-registry-fips, minio, boring-registry, falcoctl...

GHSA-HJ3V-M684-V259 vulnerabilities

Vulnerabilities for packages: mc, spire-server, falcoctl-fips, mc-fips, spire-server-fips, external-secrets-fips, minio-fips, boring-registry-fips, minio, boring-registry, falcoctl...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: boring-registry, gitsign, spire-server, mc, tekton-chains, minio, kubescape, falcoctl, vexctl...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl-fips, vexctl, kubescape, tekton-chains, falcoctl, cosign-fips...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: scorecard, terraform-provider-sendgrid-fips, bank-vaults-fips, slsa-verifier, prometheus-adapter-fips, aws-efs-csi-driver-fips, falcoctl-fips, kubeflow-fips, kubescape, kubevela, conftest-fips, prometheus-stackdriver-exporter, metrics-server-fips, k3d,...

SUSE CVE-2019-13509

In Docker CE and EE before 18.09.8 as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10, Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes non external secrets. I...

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10) Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

...