TI-2022-16400 CVE-2022-35975
Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode
Priority MEDIUM 46
The GitOps Tools Extension for VSCode can make it easier to manage Flux objects.
Weave
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
Weave records in CISA KEVNo Weave vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2020-17992 CVE-2020-35464 · GHSA-xm7q-pmpg-2fgh
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the…
Priority MEDIUM 46
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user.
Priority MEDIUM 43
The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters.
TI-2022-13142 CVE-2022-31098 · GHSA-xggc-qprg-x6mw
Weave GitOps leaked cluster credentials into logs on connection errors
Priority MEDIUM 43
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.
TI-2022-07567 CVE-2022-23508 · GHSA-wr3c-g326-486c
GitOps Run allows for Kubernetes workload injection
Priority MEDIUM 40
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.
TI-2023-17072 CVE-2023-34236 · GHSA-6hvv-j432-23cv
Information Disclosure Vulnerability in Weave GitOps Terraform Controller
Priority LOW 39
Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way.
TI-2020-16099 CVE-2020-26278
Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities
Priority LOW 36
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery.
TI-2024-16792 CVE-2024-25545 · GHSA-898m-ph5q-ggvf
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary…
Priority LOW 35
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
TI-2022-07568 CVE-2022-23509 · GHSA-89qm-wcmw-3mgg
Weave Gitops Run vulnerable to insecure communication
Priority LOW 34
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.
TI-2020-08965 CVE-2020-11091 · GHSA-59qg-grp7-5r73
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
Priority LOW 28
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service.