167 matches found
GHSA-248V-346W-9CWC vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, kubeflow-pipelines, confluent-docker-utils, az, py3-certifi, mlflow, kubeflow-katib, py3-cassandra-medusa, k8s-sidecar, kubeflow-jupyter-web-app, superset, py3-pipenv, jwt-tool, kubeflow-pipelines-visualization-server, dask-gateway, patroni,...
CVE-2024-39689 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, kubeflow-pipelines, confluent-docker-utils, az, py3-certifi, mlflow, kubeflow-katib, py3-cassandra-medusa, k8s-sidecar, kubeflow-jupyter-web-app, superset, py3-pipenv, jwt-tool, kubeflow-pipelines-visualization-server, dask-gateway, patroni,...
CVE-2024-35195 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, mlflow, py3-pipenv, kubeflow-katib, jwt-tool, py3-cassandra-medusa, kubeflow-pipelines-visualization-server, airflow, kubeflow-pipelines, confluent-docker-utils, az, k8s-sidecar, kubeflow-jupyter-web-app, superset, checkov, patroni, reflex,...
GHSA-9WX4-H78V-VM56 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, mlflow, py3-pipenv, kubeflow-katib, jwt-tool, py3-cassandra-medusa, kubeflow-pipelines-visualization-server, airflow, kubeflow-pipelines, confluent-docker-utils, az, k8s-sidecar, kubeflow-jupyter-web-app, superset, checkov, patroni, reflex,...
GHSA-JJG7-2V4V-X38H vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, nvidia-nsight-compute-13.1, kubeflow-pipelines, confluent-docker-utils, az, ggshield, kubeflow-katib, py3-cassandra-medusa, k8s-sidecar, kubeflow-jupyter-web-app, py3-idna, py3-pipenv, jwt-tool, kubeflow-pipelines-visualization-server,...
GHSA-MQ26-G339-26XF vulnerabilities
Vulnerabilities for packages: k8s-sidecar, jwt-tool...
CVE-2023-5752 vulnerabilities
Vulnerabilities for packages: k8s-sidecar, jwt-tool...
GHSA-G4MX-Q9VG-27P4 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, py3-pipenv, kubeflow-katib, nvidia-nsight-compute-13.1, jwt-tool, py3-cassandra-medusa, py3.13-scanner-test-libraries, request-1276, py3-tensorflow-serving-api, az, kubeflow-jupyter-web-app, k8s-sidecar, nvidia-nsight-compute-13.2...
CVE-2023-45803 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, py3-pipenv, kubeflow-katib, nvidia-nsight-compute-13.1, jwt-tool, py3-cassandra-medusa, py3.13-scanner-test-libraries, request-1276, py3-tensorflow-serving-api, az, kubeflow-jupyter-web-app, k8s-sidecar, nvidia-nsight-compute-13.2...
CVE-2023-45226
The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is only exposed when ssh debug is...
CVE-2023-45226
CVE-2023-45226 affects BIG-IP Next SPK, specifically the f5-debug-sidecar and f5-debug-sshd containers in SPK TMM. The issue is hardcoded credentials that could let an attacker intercept traffic and impersonate the SPK SSH server when ssh debug is enabled. Exposure is documented in multiple sourc...
PT-2023-8552 · F5 · Big-Ip
Name of the Vulnerable Software and Affected Versions: BIG-IP versions prior to the fixed version Description: The BIG-IP SPK TMM contains hardcoded credentials in the f5-debug-sidecar and f5-debug-sshd containers. This may allow an attacker to impersonate the SPK Secure Shell SSH server on those...
The Liquidity mining callpath sidecar owner can pull native tokens from the Dex
Lines of code Vulnerability details Impact The owner of liquidity mining sidecar can pull the native coins that are stored in the CrocSwapDex to reward the users. Proof of Concept The setConcRewards and setAmbRewards functions doesn't check if the quoted amount of rewards are actually sent by the...
CVE-2023-43804 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, py3.13-scanner-test-libraries, dask-gateway, kubeflow-jupyter-web-app, k8s-sidecar, kube-downscaler, py3-urllib3...
GHSA-V845-JXX5-VC9F vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, py3.13-scanner-test-libraries, dask-gateway, kubeflow-jupyter-web-app, k8s-sidecar, kube-downscaler, py3-urllib3...
This Week in Spring - August 29th, 2023 - the post SpringOne recovery blog
Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm exhausted. Seriously. Last week was mental. If you need me, I'll be over sipping on a tea... But, before that, there's a ton of things to cover from this last week, as always, and there's no rest for the curious, so let's...
GHSA-2RX4-9F5H-9GJF Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...
Arbitrary Code Execution
Apache Airflow CNCF Kubernetes is vulnerable to Arbitrary Code Execution. The vulnerability exists because the xcom sidecar image and resources are not properly restricted which allows an attacker to inject arbitrary codes to change the connection object and perform unauthorized actions...
CVE-2023-33234
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...