Security Bulletin: IBM Urbancode Deploy (UCD) is vulnerable to Insufficiently Protected LDAP Search Credentials ( CVE-2022-40751 )

Summary In certain circumstances, an Administrator user could gain access to previously configured LDAP search credentials used during authentication. Vulnerability Details CVEID:CVE-2022-40751 DESCRIPTION: IBM UrbanCode Deploy UCD 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 throu...

Security Bulletin: Urbancode Deploy is vulnerable to incorrect authorization reading Component Processes ( CVE-2022-35716 )

Summary Component process security checks can sometimes grant read-level access to users that do not have access if the process is owned by a Component Template and an endpoint performs multiple validations. Vulnerability Details CVEID:CVE-2022-35716 DESCRIPTION: IBM UrbanCode Deploy UCD could...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to Insertion of Sensitive Information into Log File vulnerability (CVE-2025-1998)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD stores potentially sensitive authentication token information in log files that could be read by a local user. Vulnerability Details CVEID:CVE-2025-1998 DESCRIPTION: IBM UrbanCode Deploy UCD stores potentially sensitive authentication token...

Malicious code in zimu-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290f844fd48d3682b9fff232fa6d8150d38d19a8553cafb8c7ed003ee0da4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in zimu-deploy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2726 Malicious code in zimu-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290f844fd48d3682b9fff232fa6d8150d38d19a8553cafb8c7ed003ee0da4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Kyverno ignores subjectRegExp and IssuerRegExp

Summary Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Details Kyverno checks only subject and issuer fields when verifying an...

CVE-2025-0255

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

CVE-2025-0255

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

CVE-2025-0255 HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

CVE-2025-0255 HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

CVE-2025-0255

CVE-2025-0255 affects HCL DevOps Deploy / HCL Launch. The vulnerability is a command-injection flaw where a remote, authenticated attacker could execute arbitrary commands by sending specially crafted input containing special elements. Evidence from multiple sources confirms the core vulnerabilit...

CVE-2025-0256

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

CVE-2025-0256

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

CVE-2025-0256 HCL DevOps Deploy / HCL Launch is susceptible to a sensitive information disclosure

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

CVE-2025-0256 HCL DevOps Deploy / HCL Launch is susceptible to a sensitive information disclosure

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

PT-2025-12660

Name of the Vulnerable Software and Affected Versions HCL DevOps Deploy / HCL Launch affected versions not specified Description The issue allows an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function. Recommendations At t...

HCL Launch和HCL DevOps Deploy 安全漏洞

HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...

PT-2025-12663

Name of the Vulnerable Software and Affected Versions HCL DevOps Deploy / HCL Launch affected versions not specified Description The issue allows a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

HCL Launch和HCL DevOps Deploy 安全漏洞

HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...