columnpack:columnpack-plugin (1.0.3), com.amazonaws:aws-codepipeline (>=0.9, <=0.45) +698 more potentially affected by CVE-2013-0327 via org.jenkins-ci.main:jenkins-core (>=1.396, <=1.480.2)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =0.9, =1.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =0.1, =0.1, =0.5, =1.9.1 and more Source cves: CVE-2013-0327 Source advisory: OSV:GHSA-RQHG-CXFR-8XQW...

GHSA-J77R-2FXF-5JRW Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...

Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...

GitHub Says Recent Attack Involving Stolen OAuth Tokens Was "Highly Targeted"

Cloud-based code hosting platform GitHub described the recent attack campaign involving the abuse of OAuth access tokens issued to Heroku and Travis CI as "highly targeted" in nature. "This pattern of behavior suggests the attacker was only listing organizations in order to identify accounts to...

GitLab resource management error vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A resource management error vulnerability exists in GitLab Community Edition and...

Attacker Breach ‘Dozens’ of GitHub Repos Using Stolen OAuth Tokens

GitHub revealed details tied to last week’s incident where hackers, using stolen OAuth tokens, downloaded data from private repositories. “We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems because the tokens in question are not stored by GitHub in thei...

Jenkins CI Game Plugin allows Cross-Site Scripting (XSS)

Cross-site Scripting XSS in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin...

Cross-site Scripting (XSS)

Overview org.jvnet.hudson.plugins:ci-game is a Jenkins Continuous Integration Game plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can inject arbitrary web script or HTML by sending a crafted request. Details Cross-site scripting or XSS is a code...

GHSA-3QXR-Q72Q-HMWP Jenkins CI Game Plugin allows Cross-Site Scripting (XSS)

Cross-site Scripting XSS in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin...

columnpack:columnpack-plugin (1.0.3), com.antelink.reporter.jenkins.plugin:antepediareporter-ci-plugin (>=1.0, <=1.6.3) +634 more potentially affected by CVE-2012-4439 via org.jenkins-ci.main:jenkins-core (>=1.396, <=1.466.1)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =0.1, =0.1, =0.5, =1.02.03, =1.0, =1.0.6 and more Source cves: CVE-2012-4439 Source advisory: OSV:GHSA-X97G-3GP9-CF2P...

ThoughtWorks GoCD Information Disclosure Vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. An information disclosure vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which could be exploited by an attacker with the right to create a new pipeline on the GoCD server by abusing the Git U...

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens

GitHub on Monday noted that it had notified all victims of an attack campaign, which involved an unauthorized party downloading private repository contents by taking advantage of third-party OAuth user tokens maintained by Heroku and Travis CI. "Customers should also continue to monitor Heroku an...

CScms SQL Injection Vulnerability (CNVD-2022-33155)

CScms is a content management system CMS developed based on the CI framework. CScms is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceDance.phpdel...

CScms SQL Injection Vulnerability (CNVD-2022-33154)

CScms is a content management system CMS developed based on the CI framework.Cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceDance.phphy...

CScms SQL Injection Vulnerability (CNVD-2022-33152)

CScms is a content management system CMS developed based on the CI framework. cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers via the component danceLists.phpzhuan...

CScms SQL Injection Vulnerability (CNVD-2022-33153)

CScms is a content management system CMS developed based on the CI framework. cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceTopic.phpdel...

ThoughtWorks GoCD path traversal vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A path traversal vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which could be exploited by an attacker compromising the GoCD agent to upload malicious files to any directory on the GoCD serve...

ThoughtWorks GoCD Cross-Site Scripting Vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A cross-site scripting vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by an attacker controlling a GoCD agent to plant malicious JavaScript into a failed job report...

GitHub Says Hackers Breached Dozens of Organizations Using Stolen OAuth Access Tokens

Cloud-based repository hosting service GitHub on Friday revealed that it discovered evidence of an unnamed adversary capitalizing on stolen OAuth user tokens to unauthorizedly download private data from several organizations. "An attacker abused stolen OAuth user tokens issued to two third-party...

Let's Dance: InsightAppSec and tCell Bring New DevSecOps Improvements in Q1

To the left, to the left, to the right, right — the CI/CD Pipeline is on the move. DevSecOps is all about adding security across the application lifecycle. A popular approach to application security is to shift left, which means moving security earlier in the software development lifecycle SDLC...