174 matches found
PT-2024-35093 · Atlantis · Atlantis
Name of the Vulnerable Software and Affected Versions: Atlantis versions prior to 0.30.0 Description: The issue concerns the exposure of GitHub credentials in Atlantis logs, specifically tokens starting with ghs ..., when they are rotated. This allows an attacker who can read these logs to...
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: step-fips, hey, cert-exporter-fips, jsonnet-bundler, secrets-store-csi-driver, configmap-reload, prometheus-pushgateway-fips, rclone, grafana-operator, local-static-provisioner, helm, chartmuseum, kubescape, neuvector-scanner, osv-scanner, docker-credential-gcr,...
atlantis-rh.fr Cross Site Scripting vulnerability OBB-3867996
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
stargate-atlantis-pandora.de Improper Access Control vulnerability OBB-3771475
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
8x8: Unprotected Atlantis Server at https://152.70.█.█
The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: hey, secrets-store-csi-driver, prometheus-pushgateway-fips, helm, node-problem-detector, chartmuseum, kubescape, dynamic-localpv-provisioner-fips, gke-gcloud-auth-plugin, smarter-device-manager-fips, kaf, k3s, kube-state-metrics-fips, kubernetes-csi-livenessprobe,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: flux-source-controller, kubescape, oauth2-proxy, terraform-provider-aws, ko, wireguard-go, kaf, src, ip-masq-agent, frp, kots, mc, secrets-store-csi-driver, metacontroller, nginx-mainline, minio, nri-prometheus, prometheus-adapter, grpcurl, helm, scorecard,...
atlantisresearch.in Cross Site Scripting vulnerability OBB-3436829
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
atlantis-land.it Cross Site Scripting vulnerability OBB-3371526
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
atlantisuniversity.edu Cross Site Scripting vulnerability OBB-3296954
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
8x8: Unprotected Atlantis Server at https://132.226.█.█
Vulnerability description not provided...
8x8: Unprotected Atlantis Server at https://152.70.█.█
Atlantis is an application for automating Terraform via pull requests. @shuvam321 reported to us an exposed Atlantis test server in our infrastructure. No sensitive information had been disclosed & we restricted access to the Atlantis service entirely, which resolved the issue...
GO-2022-0534 Timing attack in github.com/runatlantis/atlantis
Validation of Gitlab requests can leak secrets. The package github.com/runatlantis/atlantis/server/controllers/events uses a non-constant time comparison for secrets while validating a Gitlab request. This allows for a timing attack where an attacker can recover a secret and then forge the reques...
Information Disclosure
github.com/runatlantis/atlantis is vulnerable to information disclosure. The vulnerability exists in the ParseAndValidate function in gitlabrequestparservalidator.go because the webhook event is not properly validated with a constant time comparison which allows an attacker to recover the secret...
GHSA-JXQV-JCVH-7GR4 Atlantis Events vulnerable to Timing Attack
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912 Timing Attack
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912
The vulnerability is in github.com/runatlantis/atlantis/server/controllers/events (pre-0.19.7) where webhook secret validation uses a non-constant-time comparison, enabling timing attacks to recover the secret and forge webhook events. This aligns with CVE-2022-24912 and related advisories. Impac...
CVE-2022-24912 Timing Attack
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...