14320 matches found
CVE-2025-30154
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v...
GHSA-CG8R-JWG7-R2X4 CosmWasm Allows Bypass of Capability Restrictions in Blockchains
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...
CosmWasm Allows Bypass of Capability Restrictions in Blockchains
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...
CVE-2025-25500
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...
webkitgtk: out-of-bounds write vulnerability
A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds write due to improper checks to prevent unauthorized actions, causing a break out of Web Content sandbox...
CVE-2025-25500
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens PATs, npm...
CVE-2025-25500
An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...
CVE-2025-25500
CosmWasm prior to v2.2.0 is affected. The issue stems from a lack of runtime capability validation, allowing an attacker to bypass capability restrictions, deploy a contract without enforcement, and perform unauthorized blockchain actions. Affected software: CosmWasm (pre-2.2.0). Root cause: insu...
ę°ććŖGitHub Actionć®ćµćć©ć¤ćć§ć¼ć³ę»ę: reviewdog/action-setup
tj-actions/changed-files ć«åƾćććµćć©ć¤ćć§ć¼ć³ę»ęć«ćććå¤ćć®ćŖććøććŖćé±ę«ć«ę©åÆę å ±ćę¼ćććć¾ćććWiz Research ćÆćreviewdog/actions-setup@v1 ć«åƾććčæ½å ć®ćµćć©ć¤ćć§ć¼ć³ę»ęćēŗč¦ćć¦ćććććć tj-actions/changed-files ć®ä¾µå®³ć«åÆäøććåÆč½ę§ćććć¾ćć...
Malicious Code Hits ātj-actions/changed-filesā in 23,000 GitHub Repos
GitHub security alert: Malicious code found in ātj-actions/changed-files,ā impacting 23K+ repos. Learn how to check, remove, and protectā¦...
xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...
SUSE CVE-2024-52812
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service e.g. kuiperUser role can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service e.g...
CVE-2025-27915
An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A stored cross-site scripting XSS vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its...
GHSA-MRRH-FWG8-R2C3 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...