CVE-2020-2126

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system...

CVE-2020-2126: Insufficiently Protected Credentials

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system...

PT-2020-15334 · Jenkins · Jenkins Digitalocean Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins DigitalOcean Plugin version 1.1 and earlier Description: The issue concerns the storage of a token in an unencrypted form within the global config.xml file on the Jenkins master. This token can be accessed by users who have permission...

Netdata - Real-time Performance Monitoring

Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly-optimized monitoring agent you install on all your systems and containers. Netdata provides unparalleled insights , in real-time , of everything happening on the systems it runs...

Node.js third-party modules: Server Side Request Forgery in Uppy npm module

Hi Team, While we were testing our security engine at Shieldfy https://shieldfy.io, We found a server side request forgery SSRF vulnerability in Uppy npm package. It allows hacker to easily extract inside information from the server or take control of internal services. Module module name: Uppy...

Mondoo - Cloud-Native Security And Vulnerability Risk Management

Quick Start Install mondoo: Workstation export MONDOOREGISTRATIONTOKEN='changeme' curl -sSL http://mondoo.io/download.sh | bash Service export MONDOOREGISTRATIONTOKEN='changeme' curl -sSL http://mondoo.io/install.sh | bash For other installation methods, have a look at our documentation. Run a...

SSRFmap - Automatic SSRF Fuzzer And Exploitation Tool

SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform...

go.digitalocean.com XSS vulnerability

Open Bug Bounty ID: OBB-695976 Description| Value ---|--- Affected Website:| go.digitalocean.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GitLab: SSRF in CI after first run

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: During the first run, the CI...

DevOps: Vagrant with AWS EC2 & Digital Ocean

The Benefits of Vagrant Plugins Following on from my recent DevOps blog posts, The DevOps Tools We Use & How We Use Them and Vagrant with Chef-Server, we will take another step forward and look into provisioning our servers in the cloud. There are many cloud providers out there, most who provide...

Floating Domains – Taking Over 20K DigitalOcean Domains via a Lax Domain Import System

The above image is taken from here and was taken by Steve Jurvetson. EDIT: DigitalOcean seems to be getting a lot of flak from this post so I’d just like to point out that I feel DigitalOcean’s reaction in this case was entirely justified they saw an anomaly and they put a stop to it. The only...

1-click IPSEC VPN in the Cloud: algo

1-click IPSEC VPN in the Cloud Algo short for “Al Gore”, the V ice P resident of N etworks everywhere for inventing the Internet is a set of Ansible scripts that simplifies the setup of an IPSEC VPN. It contains the most secure defaults available, works with common cloud providers, and does not...

NetBox - IP Address Management (IPAM) and Data Center Infrastructure Management (DCIM) Tool

NetBox is an IP address management IPAM and data center infrastructure management DCIM tool. Initially conceived by the network engineering team at DigitalOcean , NetBox was developed specifically to address the needs of network and infrastructure engineers. NetBox runs as a web application atop...

Udemy: Misconfigured SPF Record Flag

Hello Team , Description : this report is about misconfigured spf record flag , which can be use to abuse the organization by posing the identity , which allowing to fake mailing on behalf of respected organization . About the Issue : as i seen the SPF and TXT record for the Udemy.com which is :...

Coin.Space: SMTP protection not used

Hi I'm checking your website found spf record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...

Streisand

The Internet can be a little unfair. It’s way too easy for ISPs, telecoms, politicians, and corporations to block access to the sites and information that you care about. But breaking through these restrictions is tough . Or is it? Introducing Streisand A single command sets up a brand new server...

openSUSE Security Update : python-apache-libcloud (openSUSE-SU-2014:0198-1)

Updated to 0.13.3 bnc857209, CVE-2013-6480 + Security fix release, for destroying nodes on digitalOcean 'datascrub' method is always invoked - Require python-setuptools instead of distribute upstreams merged - Updated to 0.13.2 - General : - Don't sent Content-Length: 0 header with POST and PUT...

[CVE-2013-6480] Libcloud doesn't send scrub_data query parameter when destroying a DigitalOcean node

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2013-6480 Libcloud doesn't send scrubdata query parameter when destroying a DigitalOcean node Severity: Low Vendor: Apache Software Foundation Project: Apache Libcloud http://libcloud.apache.org/ Affected Versions: Apache Libcloud 0.12.3 to 0.13...

CVE-2013-6480

Libcloud 0.12.3 through 0.13.2 does not set the scrubdata parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM...

Design/Logic Flaw

Libcloud 0.12.3 through 0.13.2 does not set the scrubdata parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM...