443 matches found
CVE-2024-35192
CVE-2024-35192 affects Trivy prior to 0.51.2. Triggering image scans from a crafted malicious registry could leak credentials for registries (e.g., AWS ECR, Google Artifact/Container Registry, Azure ACR) to the user running Trivy. The tokens could be used to push/pull images from registries the u...
CVE-2024-35192 Trivy possibly leaks registry credential when scanning images from malicious registries
Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Contain...
GHSA-XCQ4-M2R3-CMRJ Trivy possibly leaks registry credential when scanning images from malicious registries
Impact If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registr...
Trivy possibly leaks registry credential when scanning images from malicious registries
Impact If a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registr...
PT-2024-26372 · Docker +3 · Docker +3
Name of the Vulnerable Software and Affected Versions: Trivy versions prior to 0.51.2 Description: A malicious actor can trigger Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry AC...
Aqua Security Trivy 安全漏洞
Aqua Security Trivy is a comprehensive and versatile security scanner from Aqua Security. A security vulnerability exists in Aqua Security Trivy versions prior to 0.51.2, which stems from a potential leak of registry credentials when scanning images from a malicious registry...
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, cert-exporter, trillian-fips, trivy, logstash-exporter, karpenter-fips, rootlesskit, wave-fips, kafkaexporter, tigera-operator, smarter-device-manager, wgcf, zot, prometheus-stackdriver-exporter, metrics-server-fips,...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 Malicious code was discovered in the upstream ta...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 Malicious code was discovered in the upstream ta...
CVE-2024-29018 vulnerabilities
Vulnerabilities for packages: trivy, zot, dagger, tkn, up, melange, grype, conftest-fips, syft, cadvisor-fips, wolfictl, cadvisor, conftest, ctop, kubescape, buildkitd, docker-compose, kaniko, kargo, loki, spire-server-fips, cilium-cli, aactl, prometheus, crossplane, buf, ko, spire-server...
GHSA-MQ39-4GV4-MVPX vulnerabilities
Vulnerabilities for packages: trivy, zot, dagger, tkn, up, melange, grype, conftest-fips, syft, cadvisor-fips, wolfictl, cadvisor, conftest, ctop, kubescape, buildkitd, docker-compose, kaniko, kargo, loki, spire-server-fips, cilium-cli, aactl, prometheus, crossplane, buf, ko, spire-server...
openSUSE: Security Advisory for trivy (openSUSE-SU-2022:10022-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE: Security Advisory for trivy (openSUSE-SU-2023:0064-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
openSUSE: Security Advisory for trivy (openSUSE-SU-2022:10081-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-R53H-JV2G-VPX6 vulnerabilities
Vulnerabilities for packages: eksctl, flux-source-controller, helm-operator, up, trivy, flux-helm-controller, kubescape, zot, kubevela, kots, k9s, k8sgpt, zarf, helm-push, cilium-cli, chartmuseum...
GHSA-V53G-5GJP-272R vulnerabilities
Vulnerabilities for packages: eksctl, helm-push, flux-source-controller, k9s, zarf, helm-operator, kubescape, chartmuseum, zot, flux-helm-controller, cilium-cli, trivy, kots, kubevela, up, k8sgpt...
CVE-2024-25620 vulnerabilities
Vulnerabilities for packages: eksctl, flux-source-controller, helm-operator, up, trivy, flux-helm-controller, kubescape, zot, kubevela, kots, k9s, k8sgpt, zarf, helm-push, cilium-cli, chartmuseum...
GHSA-XW73-RW38-6VJC vulnerabilities
Vulnerabilities for packages: policy-controller-fips, trivy, zot, crane, argo-workflows-fips, falcoctl, kubevela, timoni, nerdctl, scorecard, dagger, up, flux-helm-controller, slsa-verifier, helm-fips, kots, kubeflow-katib, flux-image-reflector-controller, gitsign, helm, zarf, cadvisor-fips,...
CVE-2024-24557 vulnerabilities
Vulnerabilities for packages: policy-controller-fips, trivy, zot, crane, argo-workflows-fips, falcoctl, kubevela, timoni, nerdctl, scorecard, dagger, up, flux-helm-controller, slsa-verifier, helm-fips, kots, kubeflow-katib, flux-image-reflector-controller, gitsign, helm, zarf, cadvisor-fips,...