CVE-2023-50253 laf logs leak

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

Sensitive Information Disclosure

laf-client-sdk is vulnerable to Sensitive Information Disclosure. The vulnerability is caused due to directly inserting env variables into the the template while constructing the deployment instance of the app. Sensitive information in the secret and configmap can be read through the k8s envFrom...

CVE-2023-48225

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

CVE-2023-48225 Laf env causes sensitive information disclosure

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

Announcing the EKS Cluster Games

Test your investigation skills and K8s knowledge in a new Wiz-sponsored CTF event: the EKS Cluster Games!...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: smarter-device-manager-fips, prometheus-blackbox-exporter, kiam, prometheus-stackdriver-exporter, kubernetes-csi-livenessprobe, conftest-fips, kubeflow-fips, terraform-provider-sendgrid, bank-vaults-fips, terraform-provider-sendgrid-fips,...

GHSA-MQ26-G339-26XF vulnerabilities

Vulnerabilities for packages: jwt-tool, k8s-sidecar...

CVE-2023-5752 vulnerabilities

Vulnerabilities for packages: jwt-tool, k8s-sidecar...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries, py3-cassandra-medusa, nvidia-nsight-compute-13.1, request-1276, nvidia-nsight-compute-13.2, py3-tensorflow-serving-api, kubeflow-volumes-web-app, jwt-tool, kubeflow-katib, py3-pipenv, k8s-sidecar, az, kubeflow-jupyter-web-app...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: py3.13-scanner-test-libraries, py3-cassandra-medusa, nvidia-nsight-compute-13.1, request-1276, nvidia-nsight-compute-13.2, py3-tensorflow-serving-api, kubeflow-volumes-web-app, jwt-tool, kubeflow-katib, py3-pipenv, k8s-sidecar, az, kubeflow-jupyter-web-app...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: chartmuseum, prometheus-postgres-exporter, prometheus-pushgateway-fips, kaf, kube-logging-logging-operator, kubernetes-csi-livenessprobe, kubewatch, kubeflow-fips, yq, bank-vaults-fips, aws-efs-csi-driver, gke-gcloud-auth-plugin, metrics-server-fips, cue,...

CVE-2023-43804 vulnerabilities

Vulnerabilities for packages: dask-gateway, kubeflow-volumes-web-app, k8s-sidecar, py3.13-scanner-test-libraries, kube-downscaler, kubeflow-jupyter-web-app, py3-urllib3...

GHSA-V845-JXX5-VC9F vulnerabilities

Vulnerabilities for packages: dask-gateway, kubeflow-volumes-web-app, k8s-sidecar, py3.13-scanner-test-libraries, kube-downscaler, kubeflow-jupyter-web-app, py3-urllib3...

CVE-2023-32681 vulnerabilities

Vulnerabilities for packages: k8s-sidecar...

GHSA-J8R2-6X86-Q33Q vulnerabilities

Vulnerabilities for packages: k8s-sidecar...

MAL-2023-1424 Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

MAL-2023-546 Malicious code in k8s-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ccbda1c33a268bb1641ff4dc9ed60a84c28d96d167768dc09e6258fb96d697c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Feature Spotlight: Kubernetes Enforcement

Akamai’s new enforcement capabilities for K8s environments provides segmentation for applications and blocks lateral movement to, from, and inside K8s clusters...

Use of Hard-coded Credentials

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...