2779 matches found
GitLab: SSRF into Shared Runner, by replacing dockerd with malicious server in Executor
Note I've assigned the severity HIGH and submitted this report based on previously disclosed blind SSRF bugs that were previously disclosed. https://hackerone.com/reports/398799 If that's not correct, please adjust or let me know if you require more immediate impact on users in order to consider...
What are the benefits of SAST testing in CI/CD pipelines?
Static application security testing SAST is traditionally used in software development lifecycles both early on in the process and often to "white box" test all files containing source code. Integrating SAST into modern CI/CD pipelines allows developers to continuously monitor their code, providi...
Aircrack-ng 1.6 - Complete Suite Of Tools To Assess WiFi Network Security
Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: Monitoring: Packet capture and export of data to text files for further processing by third party tools. Attacking: Replay attacks, deauthentication, fake access points and...
cork (>=0.1.0, <=0.2.0), dvc (>=0.8.2, <=0.8.6) +12 more potentially affected by CVE-2019-16784 via pyinstaller (>=3.0.0, <=3.5.0)
pyinstaller PYPI version =3.0.0, =0.1.0, =0.8.2, =1.0.0.dev0, =2019.6.5, =0.1.22, =0.9.94, =0.0.1, =0.4.0, =0.1.0, =1.0.1, =0.2.0, =0.7.1 Source cves: CVE-2019-16784 Source advisory: GHSA-7FCJ-PQ9J-WH2R...
redgate-sql-ci stored credentials in plain text
redgate-sql-ci 2.0.4 and earlier stores a NuGet API key unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system. This is due to an incomplete fix of SECURITY-1598...
Managing Web Application Security
Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...
huskyCI - Performing Security Tests Inside Your CI
huskyCI is an open-source tool that performs security tests inside CI pipelines of multiple projects and centralizes all results into a database for further analysis and metrics. How does it work? The main goal of this project is to help development teams improve the quality of their code by...
CVE-2019-15589
An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...
Improper access control
An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...
CVE-2019-15589
An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...
CVE-2019-15589
An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...
CVE-2019-15589
GitLab vulnerability CVE-2019-15589 affects GitLab releases prior to 12.3.2, 12.2.6, and 12.1.12. It is described as an improper access control flaw where a blocked user could use GIT clone and pull if they had previously obtained a CI/CD token. The connected sources (OSV, NVD, CNVD, etc.) provid...
CVE-2019-15589
An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...
CVE-2019-15589
Removed by vendor...
org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2, <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2019-16552 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0, <=2.22.0)
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2019-16552 Source advisory: MEND:CVE-2019-16552...
redgate-sql-ci stores credentials in plain text
redgate-sql-ci 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins controller as part of its build step configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. redgate-sql-ci 2.0.4...
CyberRange - The Open-Source AWS Cyber Range
This CyberRange project represents the first open-source Cyber Range blueprint in the world. This project provides a bootstrap framework for a complete offensive, defensive, reverse engineering, & security intelligence tooling in a private research lab using the AWS Cloud. This project contains...
Integrate Security Testing with GitHub Actions
GitHub Actions GitHub announced their own CI/CD system which is integrated into the user interface and called Github Actions. We added RIPS to the GitHub marketplace which enables you to integrate our leading code analysis directly into your GitHub workflow. It works as a security gateway and fai...
SQL injection vulnerability in the ci*** parameter of the cm***.php page of the 100 Vail Virtual Reality Cloud Platform for Vocational Education
100 Vail Vocational Education Virtual Reality Cloud Platform is a handheld skill learning platform for workplace competency development. There is a SQL injection vulnerability in the ci parameter of the cm.php page of the 100Vail Virtual Reality Cloud Platform for Vocational Education, which can ...