CVE-2024-7634

CVE-2024-7634 affects the NGINX Agent component (NGINX Agent) where the config_dirs restriction feature allows a highly privileged attacker to write/overwrite files outside the designated secure directory. Public sources (F5 advisory) indicate a path traversal-related issue with the affected rang...

CVE-2024-7634 NGINX Agent Vulnerability

NGINX Agent's "configdirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory...

K000140630: NGINX Agent vulnerability CVE-2024-7634

Security Advisory Description NGINX Agent's configdirs restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory. CVE-2024-7634 Impact Under the default configuration, a user can overwrite arbitrary files on any...

PT-2024-6180 · Nginx · Nginx Agent

Name of the Vulnerable Software and Affected Versions: NGINX Agent affected versions not specified Description: The issue is related to the config dirs function of the NGINX Agent and NGINX Instance Manager platform, which allows an attacker to upload arbitrary files outside the intended director...

F5 Nginx 安全漏洞

F5 Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from F5 Corporation, USA, distributed under the BSD-like protocol. A security vulnerability exists in F5 Nginx, which stems from a flaw in the configdirs restriction feature. An elevated-privilege attacker...

Photon OS 5.0: Nginx PHSA-2024-5.0-0350

An update of the nginx package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0350. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

FreeBSD : nginx -- Vulnerability in the ngx_http_mp4_module (addc71b8-6024-11ef-86a1-8c164567ca3c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the addc71b8-6024-11ef-86a1-8c164567ca3c advisory. The nginx development team reports: This update fixes the buffer overread vulnerability in the...

Photon OS 4.0: Nginx PHSA-2024-4.0-0670

An update of the nginx package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0670. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Moderate Photon OS Security Update - PHSA-2024-4.0-0670

Updates of 'nginx' packages of Photon OS have been released...

BIT-NGINX-INGRESS-CONTROLLER-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

The vulnerability of the MQTT filter module in the NGINX Plus web server allows a intruder to trigger a service failure.

The vulnerability of the MQTT filter module in the NGINX Plus web server is related to the execution of operations outside the buffer in memory, as a result of the pointer being reassigned after its expiration time. Exploiting this vulnerability could allow a malicious actor to cause service...

GO-2024-3075 CVE-2024-7646 in github.com/kubernetes/ingress-nginx

CVE-2024-7646 in github.com/kubernetes/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...

Vulnerability fixed in Kubernetes

A vulnerability has been fixed in Kubernetes. The vulnerability is in the ingress-nginx module and allows a malicious person with permissions to create ingress objects to bypass a security measure to execute arbitrary code with permissions from the ingress-nginx controller. In a standard...

Moderate Photon OS Security Update - PHSA-2024-5.0-0350

Updates of 'nginx' packages of Photon OS have been released...

OPENSUSE-SU-2024:14271-1 nginx-1.27.1-1.1 on GA media

These are all security issues fixed in the nginx-1.27.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

CVE-2024-7646

The CVE-2024-7646 entry concerns ingress-nginx where an actor with permission to create Ingress objects can bypass annotation validation to inject arbitrary commands and obtain the controller’s credentials. The default configuration credential reportedly has access to all secrets in the cluster. ...

Ingress-nginx Annotation Validation Bypass

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the...