Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

JetBrains TeamCity Arbitrary Code Execution Vulnerability

TeamCity is a Java-based build management and continuous integration server from JetBrains. An arbitrary code execution vulnerability exists in JetBrains TeamCity versions prior to 2020.2.4. An attacker can exploit this vulnerability to execute arbitrary code on TeamCity Server...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2021-34744)

TeamCity is a Java-based build management and continuous integration server from JetBrains. A stored cross-site scripting vulnerability exists in several pages in versions of JetBrains TeamCity prior to 2020.2.3. Detailed vulnerability details are not available at this time...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2021-34738)

TeamCity is a Java-based build management and continuous integration server from JetBrains. A stored cross-site scripting vulnerability exists in the test page of JetBrains TeamCity versions prior to 2020.2.2. No detailed vulnerability details are available at this time...

JetBrains TeamCity Server-Side Request Forgery Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A server-side request forgery vulnerability exists...

JetBrains TeamCity Trust Management Issues Vulnerability (CNVD-2021-35238)

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A vulnerability exists in JetBrains TeamCity...

The Evolution of DevOps in 2021

DevOps has long been a key tool in helping organizations reliably and rapidly deliver systems into production. While in the past, IT and software development teams suffered from lengthy processes and struggled to resolve incompatible priorities, now DevOps allows for easier collaboration, as well...

Grow, Develop, and Impact More Than Just Your Career: Software Engineering at Rapid7 Belfast

Growth and learning – in any career at any level – are imperative for job satisfaction and company commitment. While it is necessary to have inherent curiosity as well as a desire to grow and achieve, it is also important to work for an organization that encourages and enables this curiosity and...

Unauthorized Access Vulnerability in Jenkins

Jenkins is an independent open source software project , is based on Java development of a continuous integration tool . Jenkins has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

CloudBees Jenkins CloudBees CD Plugin Authorization Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

HTTPS over HTTP: A Supply Chain Attack on Azure DevOps Server 2020

We provide the technical details of a supply chain attack on an improperly configured Azure DevOps Server 2020, specifically in the continuous integration and continuous delivery CI/CD Pipeline Agent communicating without TLS...

Security Bulletin: Security Vulnerabilities in IBM® Java SDK October 2020 and January 2021 CPU plus CVE-2020-14781, CVE-2020-14782, CVE-2020-2773 and CVE-2020-2654 affect multiple IBM Continuous Engineering products based on IBM Jazz Technology

Summary There are multiple vulnerabilities in IBM® SDK Java Technology Edition from October 2020 and January 2021 CPU, the CVE-2020-14781 deferred from Oracle Oct 2020 CPU for Java 8, CVE-2020-14782 deferred from Oracle Oct 2020 CPU for Java 8, CVE-2020-2773 deferred from Oracle Apr 2020 CPU and...

CloudBees Jenkins Data Validation Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CVE-2021-21404

Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server strelaysrv can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message...

Zero Trust: 7 adoption strategies from security leaders

Microsoft considers Zero Trust an essential component of any organization’s security plan. We have partnered with Cloud Security Alliance, a not-for-profit organization that promotes cloud computing best practices, to bring together executive security leaders to discuss and share insights about...

PT-2021-14897 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.4 and up Description: An authorization issue allowed a group maintainer to modify group CI/CD variables, which should be restricted to group owners. Recommendations: For GitLab CE/EE versions 9.4 and up, consider...

Qualys Leadership Update: Moving Forward Together

Today, we announced that Philippe Courtot has resigned from his CEO role. As you may know, Philippe took a leave of absence due to health issues unrelated to COVID-19 last month. Our thoughts are with Philippe and his family as he continues to focus on improving his health. Over the past 20 years...

5 steps to enable your corporate SOC to rapidly detect and respond to IoT/OT threats

As organizations connect massive numbers of IoT/OT devices to their networks to optimize operations, boards and management teams are increasingly concerned about the expanding attack surface and corporate liability that they represent. These connected devices can be compromised by adversaries to...

CVE-2021-26923

An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication...

Argo 信息泄露漏洞

Argo is an open source container native workflow engine. An information disclosure vulnerability exists in Argo CD versions prior to 1.8.4, which stems from the fact that accessing the endpoint api version discloses internal information about the system and the endpoint is not protected by...