Security Bulletin: A vulnerability in OpenSSL affects IBM DevOps Code ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2026-22796 Vulnerability Details CVEID:CVE-2026-22796 DESCRIPTION: Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where...

Security Bulletin: A vulnerability in OpenSSL affects IBM DevOps Code ClearCase.

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2026-22795 Vulnerability Details CVEID:CVE-2026-22795 DESCRIPTION: Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed...

Security Bulletin: A vulnerability in OpenSSL affects IBM DevOps Code ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2025-66199 Vulnerability Details CVEID:CVE-2025-66199 DESCRIPTION: Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer...

Security Bulletin: A vulnerability in OpenSSL affects IBM DevOps Code ClearCase

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM DevOps Code ClearCase. CVE-2025-11187 Vulnerability Details CVEID:CVE-2025-11187 DESCRIPTION: Issue summary: PBMAC1 parameters in PKCS12 files are missing validation which can trigger a stack-based buffe...

Security Bulletin: Due to the use of OpenSSL, IBM DevOps Code ClearCase is vulnerable to a denial of Service (CVE-2025-69421, CVE-2025-69419)

Summary OpenSSL is used by IBM DevOps Code ClearCase as part of the secure communication protocols. CVE-2025-69421, CVE-2025-69419 Vulnerability Details CVEID:CVE-2025-69419 DESCRIPTION: Issue summary: Calling PKCS12getfriendlyname function on a maliciously crafted PKCS12 file with a BMPString...

Malicious Package

Overview matlab-azure-devops-extension is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-78658 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...

CVE-2026-78658: Improper Removal of Sensitive Information Before Storage or Transfer

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an formation disclosure vulnerability when processing...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Netty vulnerabilities (CVE-2026-59899, CVE-2026-59921)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the server-agent communication systems. CVE-2026-59899, CVE-2026-59921. Vulnerability Details CVEID:CVE-2026-59899 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions...

threatcl v0.6.8

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-10842,CVE-2026-57819, CVE-2026-54225, CVE-2026-64958, CVE-2026-14981, CVE-2026-15064,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-50645, CVE-2026-9322, CVE-2026-9171 , CVE-2026-11541 ,CVE-2026-8408, CVE-2026-11712,...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in a security bulletin. CVE-2026-9072, CVE-2026-8858, CVE-2026-10852 , CVE-2026-8644, CVE-2026-9319, CVE-2026-8646,...

CVE-2020-37267

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...

CVE-2020-37267

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

EUVD-2020-31261

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2020-37267 Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2020-37267

Renovate versions >=19.180.0 and

PT-2026-78371

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...