trajan

Trajan: CI/CD 보안 스캐너 Trajan은 공격자가 소프트웨어 공급망을 손상시키는 데 사용하는 CI/CD 파이프라인의 보안 취약점을 스캔합니다. GitHub Actions, GitLab CI, Azure DevOps, Jenkins 및 JFrog를 지원합니다. 기능 Trajan은 워크플로 YAML 파일을 파싱하고, 종속성 그래프를 구축하며, 탐지 플러그인을 실행하고, 내장된 공격 기능을 통해 악용 가능성을 검증합니다. 32개의 탐지 플러그인 여러 CI/CD 플랫폼 대상 24개의 공격 플러그인 여러 CI/CD 플랫폼 대...

cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...

CICD-Goat-Vapt-Writeup

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...

zizmor

🌈 zizmor zizmor은 CI/CD 시스템을 위한 정적 분석 도구입니다. GitHub Actions, Dependabot, pre-commit을 비롯한 일반적인 CI/CD 구성에서 보안 문제를 찾아내고 수정할 수 있습니다. zizmor가 찾아내는 항목 중 일부는 다음과 같습니다: 공격자가 제어하는 코드 실행으로 이어지는 템플릿 인젝션 취약점 우발적인 자격 증명 지속 및 유출 러너에 부여된 과도한 권한 범위 및 자격 증명 사칭 커밋 및 혼동하기 쉬운 git 참조 ...그리고 훨씬 더 많은 것들! 설치 단계는 물론 빠른 시작...

cicd-sensor

이 저장소에는 README가 없습니다...

CICD-Goat-Vapt-Writeup — Updated!

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...

zizmor v1.30.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

Permissive Regular Expression

Overview Affected versions of this package are vulnerable to Permissive Regular Expression in the VerificationPolicy module when matchin refSource.URITekton. An attacker can alter verification modes or keys and potentially compromise the integrity of CI/CD pipelines by supplying resources source...

CVE-2026-24765

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage method, which deserialize...

CVE-2019-25210

An issue was discovered in Cloud Native Computing Foundation CNCF Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was...

How to Protect Your CI/CD Pipeline

Continuous integration and continuous delivery/deployment CI/CD has won over app developers, with enterprise cybersecurity teams on the hook to protect CI/CD pipelines. OWASP’s Top 10 CI/CD Security Risks clarify what to watch for...