Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...

Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c because avc_ca_pmt mishandles bounds checking.

...

Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

GoCD, written in Java, is a popular CI/CD solution with a large range of users from NGOs to Fortune 500 companies with billions of dollars in revenue. Naturally, this makes it a critical piece of infrastructure and an extremely attractive target for attackers. In order to automate build and relea...

CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avccapmt mishandles bounds checking...

DEBIAN-CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avccapmt mishandles bounds checking...

UBUNTU-CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avccapmt mishandles bounds checking...

PT-2021-26102

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.73 Description The issue is related to the Linux Kernel, specifically the ci hdrc imx driver. It has been identified that the driver may be vulnerable due to the way it handles certain parameters. The actua...

PT-2021-30164

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.12 Description The issue is related to the ci hdrc imx driver in the Linux Kernel. It has been identified that the driver may be vulnerable due to the way it handles certain parameters. The actual impact an...

PT-2021-26169

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.14.12 Description: The issue is related to the ci hdrc imx driver in the Linux Kernel. It has been identified that the driver may be vulnerable due to the way it handles certain parameters. The actual impact...

PT-2021-30097

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.73 Description The issue is related to the Linux Kernel, specifically the ci hdrc imx driver. It has been identified that the driver may be vulnerable due to the way it handles certain parameters. The actua...

CVE-2021-41148

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...

CVE-2021-41148: Improper Neutralization of Special Elements used in an SQL Command

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...

PT-2021-23128

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 11.16.99.173 Tuleap Enterprise Edition versions prior to 11.16-6 Tuleap Enterprise Edition version 11.15-8 and earlier Description The issue allows an attacker with the ability to add the CI widget to...

kernel security and bug fix update

3.10.0-1160.45.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...

To the Left: Your Guide to Infrastructure as Code for Shifting Left

It's the cloud's world now, and we're all just living in it. The mass migration of organizational infrastructure to the cloud isn't slowing down any time soon — and really, why would it? Cloud computing has allowed developers to move at vastly greater speeds than ever before. And this in turn let...

@datadog/datadog-ci (>=0.13.7-alpha, <=0.17.0-alpha), @testgram/cli (>=0.2.0, <=0.11.0) potentially affected by CVE-2020-26301 via ssh2 (>=1.1.0, <=1.3.0)

ssh2 NPM version =1.1.0, =0.13.7-alpha, =0.2.0, =0.11.0 Source cves: CVE-2020-26301 Source advisory: OSV:GHSA-652H-XWHF-Q4H6...

@datadog/datadog-ci (>=0.13.7-alpha, <=0.17.0-alpha), @testgram/cli (>=0.2.0, <=0.11.0) potentially affected by CVE-2020-26301 via ssh2 (>=1.1.0, <=1.3.0)

ssh2 NPM version =1.1.0, =0.13.7-alpha, =0.2.0, =0.11.0 Source cves: CVE-2020-26301 Source advisory: GHSA-652H-XWHF-Q4H6...

Travis CI Flaw Exposes Secrets of Thousands of Open Source Projects

Continuous integration vendor Travis CI has patched a serious security flaw that exposed API keys, access tokens, and credentials, potentially putting organizations that use public source code repositories at risk of further attacks. The issue — tracked as CVE-2021-41077 — concerns unauthorized...

CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...