Skip to content
OpenAdvisories

Vendor

weaveworks

8 known vulnerabilities.

Products

weave-gitops 3 vscode-gitops-tools 2 weave 2 tf-controller 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.2
    CVE-2022-35976

    Improper KubeConfig handling allows arbitrary code execution

    The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary code execution on behalf of the user running VSCode. Users relying on kubeconfigs that are generate…

    weaveworks vscode-gitops-tools
  • Medium 5.8
    CVE-2020-26278

    Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities

    Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any h…

    weaveworks weave
  • Medium 5.8
    CVE-2020-11091

    Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements

    In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally di…

    weaveworks weave github.com/weaveworks/weave Go