CVE-2024-7344: Improper Verification of Cryptographic Signature

Howyar UEFI Application "Reloader" 32-bit and 64-bit is vulnerable to execution of unsigned software in a hardcoded path...

Authentication flaw

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. "cmd/dex/serve.go" line 425 seemingly sets TLS 1.2 as minimum version, but the whole "tlsConfig" is ignored after "TLS cert reloader" was introduc...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws, kubeflow-katib, kube-state-metrics-fips, prometheus-pushgateway-fips, fuse-overlayfs-snapshotter, up, kubernetes-csi-livenessprobe-fips, terraform-provider-sendgrid-fips, prometheus-node-exporter, kubewatch, aws-efs-csi-driver-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nghttp2, kubewatch, kpt, envoy-ratelimit, memcached-exporter, secrets-store-csi-driver-provider-gcp, nginx-mainline, terraform-provider-azurerm, rqlite, flux-kustomize-controller, kubernetes-csi-livenessprobe, minio, bom, grype, terraform, aactl, aws-efs-csi-driver,...