CVE-2022-3474

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

Design/Logic Flaw

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

CVE-2022-3474 Bazel leaks user credentials through the remote assets API

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

CVE-2022-3474 Bazel leaks user credentials through the remote assets API

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

Bazel 安全漏洞

Bazel is a fast, scalable, multi-language and extensible build system from Bazel Open Source. A security vulnerability exists in Bazel version 3.1.0 and later, which stems from faulty credential handling in the Remote Assets API that sends all user-supplied credentials instead of only the...

CVE-2022-3474 Bazel leaks user credentials through the remote assets API

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

PT-2022-22308 · Google · Bazel

Name of the Vulnerable Software and Affected Versions: Bazel versions prior to 5.3.2 Bazel versions prior to 4.2.3 Description: A bad credential handling in the remote assets API sends all user-provided credentials instead of only the required ones for the requests. Recommendations: For Bazel...

CVE-2022-3474

CVE-2022-3474 concerns a flaw in Bazel's remote assets API where bad credential handling causes all user-provided credentials to be sent instead of only the required ones. Affected are Bazel versions prior to 5.3.2 and 4.2.3. The consequence is credential exposure for requests using this API. The...

@abc.xyz/drop-down-treeview (>=0.0.15 <=0.0.16), @abcpros/bitcore-build (>=8.25.29 <=8.25.30) +1332 more potentially affected by CVE-2022-0437 via karma (>=0.10.2 <=6.3.13)

karma NPM version =0.10.2, =0.0.15, =8.25.29, =1.0.0, =0.1.1, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =5.0.0, =0.23.0, =2.3.0, =2.11.0 and more Source cves: CVE-2022-0437 Source advisory: OSV:GHSA-7X7C-QM48-PQ9C...

Private Set Membership (PSM) - Cryptographic Protocol That Allows Clients To Privately Query

Private Set Membership PSM is a cryptographic protocol that allows clients to privately query whether the client's identifier is a member of a set of identifiers held by a server in a privacy-preserving manner. At a high level, PSM provides the following privacy guarantees: The server does not...

CVE-2021-22539

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

CVE-2021-22539

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

Path traversal

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

CVE-2021-22539 Code execution in VSCode-bazel via malicious Bazel config files

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

CVE-2021-22539

CVE-2021-22539 affects vscode-bazel. A crafted JSON config file in the project folder can point to a custom executable, because vscode-bazel allows the workspace path to lint *.bzl files to be set via this config. This enables execution of any executable on the system through vscode-bazel. The re...

PT-2021-15132 · Unknown · Vscode-Bazel

Name of the Vulnerable Software and Affected Versions: vscode-bazel versions prior to 0.4.1 Description: An attacker can place a crafted JSON config file into the project folder, pointing to a custom executable, allowing the execution of any executable on the system through vscode-bazel. This is...

Philipp Wollermann VScode-bazel 安全漏洞

Philipp Wollermann vscode-bazel is a Philipp Wollermann open source application. Bazel plugin for Visual Studio Code. A security vulnerability exists in versions prior to VScode-bazel 0.4.1, which can be exploited by attackers to execute any executable file on a system via vscode-bazel...

CVE-2021-22539

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint .bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recomme...

PathAuditor - Detecting Unsafe Path Access Patterns

The PathAuditor is a tool meant to find file access related vulnerabilities by auditing libc functions. The idea is roughly as follows: Audit every call to filesystem related libc functions performed by the binary. Check if the path used in the syscall is user-writable. In this case an unprivileg...