CVE-2024-23650 vulnerabilities

Vulnerabilities for packages: kaniko, skaffold, kubescape, conftest-fips, conftest, trivy, scorecard, zot, guac, buildkitd, docker...

CVE-2024-23650 vulnerabilities

Vulnerabilities for packages: conftest, docker, zot, kubescape, trivy, kaniko, guac, buildkitd, scorecard, skaffold...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: podman, wolfictl, syft, kubescape, nerdctl, cadvisor, k9s, zarf, kubernetes, k3d, buildkitd, kaniko, ctop, newrelic-infrastructure-agent, skopeo, trivy, zot, docker, kots, k3s, skaffold, grype, runc...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: syft, zot, kubescape, cadvisor, newrelic-infrastructure-agent, kaniko, kubernetes, buildkitd, kots, zarf, runc, k9s, podman, trivy, nerdctl, ctop, wolfictl, k3s, skaffold, docker, skopeo, k3d, grype...

GitLab < 15.7.8 (SECURITY-RELEASE-GITLAB-15-9-2-RELEASED)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A speciall...

Malicious code in @msmg-money/vue-datadog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1afb2963e775c73460d75d193db4105cc50b30e6856ec840c7a9bd4d77fee96a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unsanitized user controlled input in module generation

Impact The import-in-the-middle loader used by @opentelemetry/instrumentation works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes...

import-in-the-middle Input Validation Error Vulnerability

import-in-the-middle is an intermediate requirements-inspired module loading interceptor open-sourced by Datadog. An input validation error vulnerability exists in import-in-the-middle 1.4.2. An attacker exploiting this vulnerability could remotely execute code...

API Token Disclosure

gitlab is vulnerable to API Token Disclosure. The vulnerability exists due to Insufficient permission checks, which allows an attacker to exfiltrate a Datadog API key...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability occurs due to incorrect data handling within the datadog integration resulting in gitlab returning contributor emails...

Cross-Site Scripting (XSS)

gitLab is vulnerable to Cross-Site Scripting XSS. This vulnerability occurs due to a flaw in the way that GitLab handles the DataDog integration configuration. An attacker can exploit this vulnerability to inject malicious code into a project's DataDog configuration, which can then be executed by...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability allows a project maintainer to access the DataDog integration API key from webhook logs resulting in disclosure of sensitive information...

Improper Access Control

Datadog Plugin is vulnerable to Improper Access Control. The vulnerability exists due to lack of permission checks in an HTTP endpoint which allows an attacker to connect to a specified Datadog URL using captured ID's from another method, resulting in Jenkins credential exposure...

Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint.

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

GHSA-W3P4-7823-M33Q Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint.

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

CVE-2023-37944

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37944

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Design/Logic Flaw

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37944

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37944

The CVE-2023-37944 issue affects Jenkins Datadog Plugin (versions up to 5.4.1). A missing permission check on an HTTP endpoint allows attackers with Overall/Read to connect to an attacker-specified URL using attacker-specified credentials IDs, enabling capture of credentials stored in Jenkins. Mi...