2129 matches found
CVE-2025-1767
CVE-2025-1767 affects Kubernetes clusters using the in-tree gitRepo volume to clone git repositories from pods on the same node. The in-tree gitRepo volume feature is deprecated and will not receive security updates upstream; clusters still using this feature remain vulnerable. The connected docu...
AI-Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
In this blog entry, we uncovered a campaign that uses fake GitHub repositories to distribute SmartLoader, which is then used to deliver Lumma Stealer and other malicious payloads. The campaign leverages GitHub’s trusted reputation to evade detection, using AI-generated content to make fake...
Exploit for Unrestricted Upload of File with Dangerous Type in Git
CVE-2024-32002: Exploiting Git RCE via git clone This repos...
12,000+ API Keys and Passwords Found in Public Datasets Used for LLM Training
A dataset used to train large language models LLMs has been found to contain nearly 12,000 live secrets, which allow for successful authentication. The findings once again highlight how hard-coded credentials pose a severe security risk to users and organizations alike, not to mention compounding...
Hackers Exploit Fake GitHub Repositories to Spread GitVenom Malware
Kaspersky's Securelist exposes the GitVenom campaign involving fake GitHub repositories to distribute malware. Targeting developers with seemingly legitimate…...
The GitVenom campaign: cryptocurrency theft using GitHub
In our modern world, it's difficult to underestimate the impact that open-source code has on software development. Over the years, the global community has managed to publish a tremendous number of projects with freely accessible code that can be viewed and enhanced by anyone on the planet. Very...
UBUNTU-CVE-2024-31144
For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside ...
CVE-2024-31144 Xapi: Metadata injection attack against backup/restore functionality
For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside ...
CVE-2024-31144
The Xapi component in Xen is vulnerable to a metadata injection attack during backup and restore operations. The vulnerability occurs because the host administrator's system searches for and mounts Virtual Disk Images (VDIs) in alphanumeric order by UUID to locate metadata. Since a malicious gues...
CVE-2024-31144 Xapi: Metadata injection attack against backup/restore functionality
For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.htmlobject-model-overview Xapi contains functionality to backup and restore metadata about Virtual Machines and Storage Repositories SRs. The metadata itself is stored in a Virtual Disk Image VDI inside ...
CVE-2025-26495
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token PAT into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19...
The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure
Learn how Wiz for ASPM extends security to developer infrastructure by continuously enforcing secure defaults and detecting threats across the software supply chain...
CVE-2025-1042: Files or Directories Accessible to External Parties
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way...
CVE-2025-26495
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token PAT into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19...
CVE-2025-26495
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token PAT into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19...
CVE-2025-26495
A Cleartext Storage of Sensitive Information vulnerability exists in Salesforce Tableau Server , where Personal Access Tokens (PAT) can be recorded into logging repositories. This issue affects Tableau Server versions prior to 2022.1.3 , 2021.4.8 , 2021.3.13 , 2021.2.14 , 2021.1.16 , and 2020.4.1...
CVE-2025-26495: Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token PAT into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19...
CVE-2024-1482
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUBTOKEN. To exploit this vulnerability, an attacker would need access...
CVE-2025-24886
CVE-2025-24886 involves pwn.college’s Dojo tooling where incorrect symbolic link checks on user-specified dojos allow an LFI from the CTFd container without admin privileges. A malicious user can craft a repository containing symlinks to sensitive files and retrieve them via the CTFd website when...