cncf records

8 published records for vendor cncf.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 87.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-38495No exploit	Crossplane vulnerable to possible image tampering from missing image validation for Packagescncf · crossplane · CWE-20 Pre-auth	Critical9.8	—	0.8%	Jul 27, 2023
32Monitor	CVE-2021-27098No exploit	In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPcncf · spire · CWE-295 Weak crypto	High8.1	—	0.6%	Mar 5, 2021
31Monitor	CVE-2019-9946No exploit	Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kucncf · portmap · CWE-670 Pre-auth	High7.5	—	3.2%	Apr 2, 2019
31Monitor	CVE-2020-8659No exploit	CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e.cncf · envoy · CWE-770 Pre-auth Denial of service	High7.5	—	1.9%	Mar 4, 2020
31Monitor	CVE-2020-8661No exploit	CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.cncf · envoy · CWE-400 Pre-auth Denial of service	High7.5	—	1.9%	Mar 4, 2020
27Monitor	CVE-2021-27099No exploit	In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided througcncf · spire · CWE-863 Broken access control (IDOR)	Medium6.8	—	0.7%	Mar 5, 2021
21Monitor	CVE-2020-8664No exploit	CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context.cncf · envoy · CWE-287 Pre-auth Auth bypass	Medium5.3	—	1.3%	Mar 4, 2020
10Monitor	CVE-2023-37900No exploit	Crossplane vulnerable to denial of service from large imagecncf · crossplane · CWE-400 Denial of service	Low2.7	—	0.6%	Jul 27, 2023

CVE-2023-38495
39Monitor
Crossplane vulnerable to possible image tampering from missing image validation for Packages
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
cncf · crossplaneJul 27, 2023
CVE-2021-27098
32Monitor
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SP
HighCVSS 8.1No exploitEPSS 1%
- Weak crypto
cncf · spireMar 5, 2021
CVE-2019-9946
31Monitor
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Ku
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
cncf · portmapApr 2, 2019
CVE-2020-8659
31Monitor
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e.
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Denial of service
cncf · envoyMar 4, 2020
CVE-2020-8661
31Monitor
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Denial of service
cncf · envoyMar 4, 2020
CVE-2021-27099
27Monitor
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided throug
MediumCVSS 6.8No exploitEPSS 1%
- Broken access control (IDOR)
cncf · spireMar 5, 2021
CVE-2020-8664
21Monitor
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context.
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
cncf · envoyMar 4, 2020
CVE-2023-37900
10Monitor
Crossplane vulnerable to denial of service from large image
LowCVSS 2.7No exploitEPSS 1%
- Denial of service
cncf · crossplaneJul 27, 2023