GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: tflint, kube-bench, kubevela, dockerize, mockery, flux-image-reflector-controller, k3s, kubeflow-katib, kubernetes-event-exporter, wireguard-go, flux, nerdctl, wait-for-port, logstash-exporter, envoy-ratelimit, govulncheck, k8sgpt-operator, pombump, speedtest-go,...

Malware in auth0-logs-to-datadog

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Doppler announces integration with Datadog to streamline security and monitoring

San Francisco, United States / California, 30th January 2025, CyberNewsWire...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

GHSA-5VVG-PVHP-HV2M vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-49750 vulnerabilities

Vulnerabilities for packages: airflow...

com.piketec.jenkins.plugins:piketec-tpt (6.3), org.datadog.jenkins.plugins:datadog (>=1.1.2, <=1.2.0) +4 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.632)

org.jenkins-ci.main:jenkins-core MAVEN version 1.632 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.piketec.jenkins.plugins:piketec-tpt 6.3 - org.datadog.jenkins.plugins:datadog =1.1.2, =1.0,...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: zot, cosign, kubescape, snyk-cli, spire-server-fips, tfsec, conftest, policy-controller-fips, kots, zarf, conftest-fips, policy-controller, spire-server, opa, cosign-fips, k8sgpt...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: tfsec, zot, opa, snyk-cli, zarf, k8sgpt, kubescape, kots, spire-server, cosign, conftest, policy-controller...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: tfsec, zot, opa, snyk-cli, zarf, k8sgpt, kubescape, kots, spire-server, cosign, conftest, policy-controller...

com.piketec.jenkins.plugins:piketec-tpt (6.3), org.datadog.jenkins.plugins:datadog (>=1.1.2, <=1.2.0) +4 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.632)

org.jenkins-ci.main:jenkins-core MAVEN version 1.632 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.piketec.jenkins.plugins:piketec-tpt 6.3 - org.datadog.jenkins.plugins:datadog =1.1.2, =1.0,...

com.piketec.jenkins.plugins:piketec-tpt (6.3), org.datadog.jenkins.plugins:datadog (>=1.1.2, <=1.2.0) +4 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.632)

org.jenkins-ci.main:jenkins-core MAVEN version 1.632 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.piketec.jenkins.plugins:piketec-tpt 6.3 - org.datadog.jenkins.plugins:datadog =1.1.2, =1.0,...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-655)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-655 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann...

Trojanized jQuery Packages Found on npm, GitHub, and jsDelivr Code Repositories

Unknown threat actors have been found propagating trojanized versions of jQuery on npm, GitHub, and jsDelivr in what appears to be an instance of a "complex and persistent" supply chain attack. "This attack stands out due to the high variability across packages," Phylum said in an analysis...

GHSA-248V-346W-9CWC vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, az, kubeflow-katib, barman, jwt-tool, nvidia-nsight-compute-13.2, checkov, py3-pipenv, request-1276, reflex, dask-gateway, kubeflow-pipelines, mlflow, py3-cassandra-medusa, py3-certifi, kubeflow-pipelines-visualization-server,...

GHSA-MH55-GQVF-XFWM vulnerabilities

Vulnerabilities for packages: grafana-mimir, fulcio, cortex, timestamp-authority, prometheus-alertmanager, rekor...

CVE-2024-39689 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, az, kubeflow-katib, barman, jwt-tool, nvidia-nsight-compute-13.2, checkov, py3-pipenv, request-1276, reflex, dask-gateway, kubeflow-pipelines, mlflow, py3-cassandra-medusa, py3-certifi, kubeflow-pipelines-visualization-server,...