Neuvector
Monthly
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.