7401 matches found
CLSA-2023-1698689944 nginx: Fix of CVE-2023-44487
CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...
GHSA-FJHG-96CP-6FCW Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Description The laters version of Kimai is found to be vulnerable to a critical Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML...
Urgent: New Security Flaws Discovered in NGINX Ingress Controller for Kubernetes
Three unpatched high-severity security flaws have been disclosed in the NGINX Ingress controller for Kubernetes that could be weaponized by a threat actor to steal secret credentials from the cluster. The vulnerabilities are as follows - CVE-2022-4886 CVSS score: 8.8 - Ingress-nginx path...
Arbitrary Code Execution
github.com/kubernetes/ingress-nginx is vulnerable to Arbitrary Code Execution. The vulnerability arises from the library's default lack of proper annotation validation. This deficiency enables an attacker to inject and execute malicious code through the...
Improper Access Control
github.com/kubernetes/ingress-nginx is vulnerable to Improper Access Control. The vulnerability exists because the library does not adequately validate path types. Consequently, an attacker with the ability to create or update ingress objects can utilize directives to evade the sanitization of th...
SUSE CVE-2022-4886
Ingress-nginx path sanitization can be bypassed with logformat directive...
SUSE CVE-2023-5043
Ingress nginx annotation injection causes arbitrary command execution...
SUSE CVE-2023-5044
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...
Oracle Linux 9 : nginx:1.22 (ELSA-2023-6120)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6120 advisory. 1:1.22.1-3.0.1.1 - Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack CVE-2023-44487 Tenable has extracted the preceding description block...
AlmaLinux 9 : nginx:1.22 (ALSA-2023:6120)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:6120 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...
The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component in the Kubernetes ingress-nginx cluster allows a attacker to execute arbitrary code or escalate their privileges.
The vulnerability of the nginx.ingress.kubernetes.io/configuration-snippet component, which handles incoming traffic in the Kubernetes ingress-nginx cluster, is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase...
GHSA-5WJ4-WFFQ-3378 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
Ingress nginx annotation injection causes arbitrary command execution
Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...
GHSA-5WJ4-WFFQ-3378 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
GHSA-FP9F-44C2-CW27 Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...
GHSA-FP9F-44C2-CW27 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...
GHSA-5WJ4-WFFQ-3378 Ingress nginx annotation injection causes arbitrary command execution
Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...