testkube-operator-2.1.146_linux_arm64

digest	sha256:3782399cb77acd2a70180a5fe45edc7216c807b2fa85831451ea8fff04a8101a
vulnerabilities
platform	linux/arm64
size	16 MB
packages	94

golang.org/x/oauth2 0.26.0 (golang) pkg:golang/golang.org/x/oauth2@0.26.0 Affected range <0.27.0 Fixed version 0.27.0 EPSS Score 0.051% EPSS Percentile 16th percentile Description An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

golang.org/x/net 0.34.0 (golang) pkg:golang/golang.org/x/net@0.34.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <0.38.0 Fixed version 0.38.0 CVSS Score 5.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N EPSS Score 0.016% EPSS Percentile 2nd percentile Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. $,,\; etc\; contexts).$ Misinterpretation of Input Affected range <0.36.0 Fixed version 0.36.0 CVSS Score 4.4 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L EPSS Score 0.009% EPSS Percentile 1st percentile Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

k8s.io/apiserver 0.32.0 (golang) pkg:golang/k8s.io/apiserver@0.32.0 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.15.10 Fixed version 1.15.10, 1.16.7, 1.17.3 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.161% EPSS Percentile 38th percentile Description The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.