cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2025-0754,https://securityvulnerability.io/vulnerability/CVE-2025-0754,Log Injection Vulnerability in OpenShift Service Mesh by Red Hat,"An issue has been identified in OpenShift Service Mesh versions 2.6.3 and 2.5.6, stemming from improper sanitization of HTTP headers by Envoy, specifically the x-forwarded-for header. This flaw permits attackers to inject malicious payloads into service mesh logs, facilitating log injection and spoofing attacks. Consequently, this exploitation can distort logging processes, allowing adversaries to manipulate log entries or potentially execute reflected cross-site scripting (XSS) attacks, posing significant risks to the overall integrity and security of the environment.",Red Hat,Openshift Service Mesh 2,4.3,MEDIUM,0.00044999999227002263,false,,false,false,false,,false,false,false,,2025-01-28T09:37:11.500Z,0
CVE-2025-0752,https://securityvulnerability.io/vulnerability/CVE-2025-0752,Access Control Vulnerabilities in OpenShift Service Mesh by Red Hat,"A flaw in OpenShift Service Mesh versions 2.6.3 and 2.5.6 has been identified, which may allow for rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and potential replay attacks. This vulnerability stems from inadequate sanitization of HTTP headers within Envoy, necessitating urgent attention to patch affected systems to prevent exploitation.",Red Hat,Openshift Service Mesh 2,6.3,MEDIUM,0.0004400000034365803,false,,false,false,false,,false,false,false,,2025-01-28T09:29:33.073Z,0
CVE-2024-7207,https://securityvulnerability.io/vulnerability/CVE-2024-7207,Envoy Proxy Vulnerability Allows Header Manipulation and Request Forgery,"The vulnerability identified has been marked as a duplicate of CVE-2024-45806, suggesting a redundancy in reporting. However, it is critical to monitor and address any existing weaknesses in Envoy Proxy that may arise from overlapping vulnerabilities. Users and system administrators should stay informed about security advisories from the Envoy Project to ensure all systems running Envoy are updated and compliant with the latest security practices.",Red Hat,Openshift Service Mesh 2,9.8,CRITICAL,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-09-19T22:17:51.582Z,0
CVE-2023-3089,https://securityvulnerability.io/vulnerability/CVE-2023-3089,Ocp & fips mode,"A compliance issue has been identified in the Red Hat OpenShift Container Platform when operated in FIPS mode, where not all utilized cryptographic modules were validated against FIPS standards. This could potentially impact the security posture within environments that require FIPS-compliant cryptographic solutions, urging users to review their configurations and understand the implications on their compliance requirements.",Red Hat,"Openshift,Openshift Serverless,Openshift Service Mesh 2.2.x,Openshift Service Mesh 2.3.x,Openshift Service Mesh 2.4,Red Hat Advanced Cluster Management For Kubernetes 2,Red Hat Jboss A-MQ Streams,Red Hat Openshift Container Platform 3.11,Red Hat Openshift Container Platform 4,Red Hat Openshift Data Foundation 4,Red Hat Openshift Sandboxed Containers,Red Hat Openshift Virtualization 4",7,HIGH,0.001230000052601099,false,,false,false,false,,,false,false,,2023-07-05T13:15:00.000Z,0