479 matches found
AZL-39704 CVE-2024-28180 affecting package telegraf for versions less than 1.31.0-1
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...
AZL-35751 CVE-2024-28110 affecting package telegraf for versions less than 1.31.0-1
Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...
CVE-2024-28110 vulnerabilities
Vulnerabilities for packages: guac, falcosidekick, falcosidekick-fips...
AZL-35761 CVE-2024-28110 affecting package telegraf for versions less than 1.28.5-5
Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...
GHSA-5PF6-2QWX-PXM2 vulnerabilities
Vulnerabilities for packages: guac, falcosidekick...
GHSA-5PF6-2QWX-PXM2 vulnerabilities
Vulnerabilities for packages: guac, falcosidekick, falcosidekick-fips...
AZL-35752 CVE-2024-27304 affecting package telegraf for versions less than 1.31.0-1
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. T...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: kine, spicedb, argo-workflows, k3s, temporal-server, kube-bench-fips, step-ca, argo-workflows-fips, caddy-fips, ferretdb, step, wavefront-collector-for-kubernetes, amass, kube-bench, src, trillian-fips, temporal-server-fips, kots, trillian, falcosidekick-fips, caddy...
AZL-35762 CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. T...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: kine, step-ca, k3s, amass, caddy, ferretdb, step, argo-workflows, spicedb, temporal-server, src, kots, kube-bench, trillian...
AZL-35763 CVE-2024-27289 affecting package telegraf for versions less than 1.29.4-4
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for ...
CVE-2024-27289 vulnerabilities
Vulnerabilities for packages: step-ca, caddy, step, argo-workflows, kots, trillian...
AZL-35750 CVE-2024-27289 affecting package telegraf for versions less than 1.31.0-1
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for ...
AZL-35599 CVE-2024-24786 affecting package telegraf for versions less than 1.29.4-8
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: chartmuseum, kube-logging-operator, timestamp-authority-fips, fuse-overlayfs-snapshotter, cilium, kargo, request-1279, kpt, crossplane-provider-aws-cloudformation, gomplate, crossplane-provider-aws-dynamodb, kubernetes-event-exporter, velero, melange, nri-kubernetes,...
AZL-35673 CVE-2024-24786 affecting package telegraf for versions less than 1.31.0-1
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
GHSA-7JWH-3VRQ-Q3M8 vulnerabilities
Vulnerabilities for packages: kine, step-ca, k3s, amass, caddy, ferretdb, step, argo-workflows, spicedb, temporal-server, src, kots, kube-bench, trillian...
GHSA-7JWH-3VRQ-Q3M8 vulnerabilities
Vulnerabilities for packages: kine, spicedb, argo-workflows, k3s, temporal-server, kube-bench-fips, step-ca, argo-workflows-fips, caddy-fips, ferretdb, step, wavefront-collector-for-kubernetes, amass, kube-bench, src, trillian-fips, temporal-server-fips, kots, trillian, falcosidekick-fips, caddy...
GHSA-MRWW-27VC-GGHV vulnerabilities
Vulnerabilities for packages: kine, spicedb, argo-workflows, k3s, temporal-server, kube-bench-fips, step-ca, argo-workflows-fips, caddy-fips, ferretdb, step, wavefront-collector-for-kubernetes, amass, kube-bench, src, trillian-fips, temporal-server-fips, kots, trillian, falcosidekick-fips, caddy...