CVE-2025-24362

CVE-2025-24362 concerns CodeQL Action when debug artifacts are enabled. In certain failed CodeQL analyses on Java/Kotlin repos, the uploaded debug artifacts could contain environment variables from the workflow run, including secrets such as the GITHUB_TOKEN. The token could be valid for the dura...

The anatomy of a Toxic Combination of Risk

How to uncover potential threats and eliminate critical risks in your cloud environment...

PT-2025-5344 · Github · Codeql Action +1

Name of the Vulnerable Software and Affected Versions: CodeQL Action versions prior to 3.28.3 CodeQL CLI versions prior to 2.20.3 Description: In certain circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain environment variables from t...

Important: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

ASTEVAL 安全漏洞

ASTEVAL is an open source library from lmfit that uses the ast module for parsimony evaluation of python expressions. A security vulnerability exists in ASTEVAL versions prior to 1.0.6, which stems from If an attacker has control over the inputs to the asteval library, it is possible to bypass...

Important: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...

CodeQL Action 日志信息泄露漏洞

CodeQL Action is a GitHub open source application. It is used to run CodeQL, GitHub's industry-leading static analysis engine, on repository source code to find security vulnerabilities. A log message disclosure vulnerability exists in CodeQL Action versions prior to 3.28.3, which stems from...

CVE-2021-42718

Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin...

CVE-2021-42718

CVE-2021-42718 affects Replicated Classic versions prior to 2.53.1. An authenticated Admin Console API (port 8800) may exposed container definitions containing environment variables, potentially revealing application secrets. Impact is information disclosure for users with valid credentials and A...

GHSA-74J9-XHQR-6QV3 Reflected Cross Site Scripting (XSS) in error message

If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message...

Reflected Cross Site Scripting (XSS) in error message

If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message...

PT-2025-1359 · Unknown · Replicated Classic

Name of the Vulnerable Software and Affected Versions: Replicated Classic versions prior to 2.53.1 Description: The issue allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables...

RestrictedPython 安全漏洞

RestrictedPython is an open source tool from Zope that helps define a subset of the Python language that allows program input to be provided to a trusted environment. A security vulnerability exists in RestrictedPython that stems from a type confusion error when using "try/except"...

The vulnerability of the trusted execution environment of the Virtualization-Based Security (VBS) Enclave in Microsoft Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the trusted execution environment for the Virtualization-Based Security VBS Enclave in Microsoft Windows operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow attackers to enhance their privileges...

Moderate: Red Hat Security Advisory: java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5

An update for java-17-openjdk is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8, Red Hat Enterprise...

Moderate: Red Hat Security Advisory: java-17-openjdk security update for RHEL 8.4

An update for java-17-openjdk is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this...

Moderate: Red Hat Security Advisory: java-11-openjdk ELS security update

An update for java-11-openjdk with Extended Lifecycle Support is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit...

RHEL 8 / 9 : java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0422)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0422 advisory. The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JD...

Oracle MySQL Server 8.0 - 8.0.40, 8.4 - 8.4.3, 9.0 - 9.1.0 Security Update (cpujan2025) - Windows

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

ALSA-2025:0426 Moderate: java-21-openjdk security update for AlmaLinux 8.10, 9.4 and 9.5

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes: JDK: Enhance array handling CVE-2025-21502 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...