EMERALDWHALE Steals 15,000+ Cloud Credentials, Stores Data in S3 Bucket

Operation EMERALDWHALE compromises over 15,000 cloud credentials, exploiting exposed Git and Laravel files. Attackers use compromised S3 buckets…...

Massive Git Config Breach Exposes 15,000 Credentials; 10,000 Private Repos Cloned

Cybersecurity researchers have flagged a "massive" campaign that targets exposed Git configurations to siphon credentials, clone private repositories, and even extract cloud credentials from the source code. The activity, codenamed EMERALDWHALE , is estimated to have collected over 10,000 private...

GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.

...

Low: gdb

Issue Overview: GNU gdb GDB 13.0.50.20220805-git was discovered to contain a stack overflow via the function adadecode at /gdb/ada-lang.c. CVE-2023-39128 GNU gdb GDB 13.0.50.20220805-git was discovered to contain a heap use after free via the function addpeexportedsym at /gdb/coff-pe-read.c...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.37 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.37 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Debian: Security Advisory (DLA-3939-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3939-1] python-git security update

Debian LTS Advisory DLA-3939-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert October 29, 2024 https://wiki.debian.org/LTS Package : python-git Version : 3.1.14-1+deb11u1 CVE ID : CVE-2022-24439 CVE-2023-40267 CVE-2023-41040 Debian Bug : 1027163 1043503 GitPython...

Debian dla-3939 : python-git-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3939 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3939-1 [email protected]...

DLA-3939-1 python-git - security update

Bulletin has no description...

Metasploit Weekly Wrap-Up 10/25/2024

Hackers and Vampires Agree: Every Byte Counts Headlining the release today is a new exploit module by jheysel-r7 that chains two vulnerabilities to target Magento/Adobe Commerce systems: the first, CVE-2024-34102 is an arbitrary file read used to determine the version and layout of the glibc...

Malicious code in git-commit-message-convention (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d09a62681923adfe2316c61633ccb26eeaa743e0350118824ffd40bb4c038c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9461 Malicious code in git-commit-message-convention (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d09a62681923adfe2316c61633ccb26eeaa743e0350118824ffd40bb4c038c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Unrestricted Upload of File with Dangerous Type in Git

CVE-2024-32002 Versions 1.0.0https://github.com/grec...

GHSA-QM7J-C969-7J4Q

creationtimestamp| type| source ---|---|--- 2024-10-21 17:03:42+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/970 2025-01-14 17:04:36+00:00| seen| https://github.blog/open-source/git/git-security-vulnerabilities-announced-5/ 2025-01-14 19:10:45+00:00| seen|...

CVE-2020-5260

creationtimestamp| type| source ---|---|--- 2024-10-21 17:03:42+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/970 2025-01-14 17:04:36+00:00| seen| https://github.blog/open-source/git/git-security-vulnerabilities-announced-5/ 2025-01-14 19:10:45+00:00| seen|...

CVE-2024-45309

OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9...

CVE-2024-45309 OneDev vulnerable to arbitrary file reading for unauthenticated user

OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9...

CVE-2024-45309

OneDev.io prior to 11.0.9 is vulnerable to an unauthenticated arbitrary file read via directory traversal, exposing files accessible by the server process. Affected versions are ≤11.0.8 (per the Nuclei template) with the fix in 11.0.9. Impact is exposure of host files; exploitation details are no...

The vulnerability of the Red Hat OpenShift Container Platform corporate platform, related to insecure privilege management, allows a perpetrator to elevate their privileges and execute arbitrary commands.

The vulnerability of the Red Hat OpenShift Container Platform is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary commands using a specially created .gitconfig file during cloning processes...

Denial of Service (DoS)

Overview org.webjars.npm:pacote is a JavaScript package downloader Affected versions of this package are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege...