118 matches found
CVE-2020-8567 Kubernetes Secrets Store CSI Driver plugin directory traversals
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
CVE-2020-8567
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
CVE-2020-8567
The CVE concerns Kubernetes Secrets Store CSI Driver plugins (Vault: pre-v0.0.6, Azure: pre-v0.0.10, GCP: pre-v0.2.0) that allow an attacker who can create SecretProviderClass objects to write to arbitrary file paths on the host filesystem (including /var/lib/kubelet/pods). Root cause: insecure h...
PT-2021-12792
Name of the Vulnerable Software and Affected Versions: Kubernetes Secrets Store CSI Driver Vault Plugin versions prior to v0.0.6 Kubernetes Secrets Store CSI Driver Azure Plugin versions prior to v0.0.10 Kubernetes Secrets Store CSI Driver GCP Plugin versions prior to v0.2.0 Description: The issu...
CVE-2020-8567: Path Traversal: '../filedir'
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods...
Kubernetes SIGs Secrets-store-csi-driver path traversal vulnerability
Kubernetes SIGs Secrets-store-csi-driver is a K8s component for storing confidential files based on CSI volumes from the Kubernetes SIGs organization. A security vulnerability in the Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6 can be exploited by an attacker to create special...
CVE-2020-2313
A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2020-2313
Summary: CVE-2020-2313 affects the Jenkins Azure Key Vault Plugin (versions 2.0 and earlier). The issue is a missing permission check on multiple HTTP endpoints, allowing attackers who have Overall/Read permission to enumerate credentials IDs stored in Jenkins. Impact (as stated): Credentials IDs...
CVE-2020-2313
A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2020-2313: Undefined Security Weakness
A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2019-10435
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
Code injection
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
CVE-2019-10435
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
CVE-2019-10435
CVE-2019-10435 affects the Jenkins SourceGear Vault Plugin. The vulnerability arises because the plugin transmits configured credentials in plain text within job configuration forms, potentially exposing sensitive data. Several connected sources (GHSA, RH, PT-Security, CNVD, CNVD- etc.) confirm t...
CVE-2019-10435
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
CVE-2019-10435: Cleartext Transmission of Sensitive Information
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
PT-2019-11829 · Sourcegear +1 · Jenkins Sourcegear Vault Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins SourceGear Vault Plugin affected versions not specified Description: The Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. There...
