Fern Pattern Scanner

Fern 패턴 스캐너 Fern의 패턴 스캐너에 오신 것을 환영합니다. 이 스캐너는 사용자가 제안한 파일을 스캔하고 rules/rules.yaml에서 명시된 모든 패턴을 regex를 사용하여 찾습니다. 그런 다음 모든 발견 사항과 함께 보고서가 생성됩니다. 이 프로젝트는 사용자 정의 보안 스캐너가 GitLab에 통합되는 방법을 보여주기 위해 사용되며, 파이프라인 보안 탭, 취약점 보고서 및 병합 요청 위젯을 채우는 데 사용될 수 있습니다. 참고 : 취약점 보고서에 접근하려면 GitLab Ultimate 구독이 필요합니다...

GitLeaks

Компонент GitLeaks для GitLab CI Компонент GitLab CI для Gitleaks — инструмента SAST для обнаружения и предотвращения жёстко закодированных секретов, таких как пароли, ключи API и токены, в git-репозиториях. Возможности Обнаружение секретов : Сканирует репозитории на наличие жёстко закодированных...

trivy

Trivy GitLab CI Компонент Компонент GitLab CI для Trivy — универсального сканера безопасности, охватывающего образы контейнеров, файловые системы, репозитории, кластеры Kubernetes, SBOM и лицензионную совместимость. Подключайте эти шаблоны напрямую в свои конвейеры, чтобы получать повторяемые...

GitLeaks

Образ контейнера GitLeaks Сборка gitleaks с определёнными настройками для сканирования секретов в локальных рабочих процессах и пайплайнах. Возможности Собирает gitleaks из помеченного исходного кода с фиксированными цепочками инструментов Go для воспроизводимых бинарных файлов. Компонент GitLab ...

Dependency Scanning v2.1.1

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

CVE-2025-1677

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

EUVD-2019-15045

Malware in sbrugna...

EUVD-2020-5548

Malware in sbrugna...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-13003

An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-503.14.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Oracle Linux 9 : kernel (ELSA-2024-3306)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3306 advisory. - netfilter: nftables: disallow anonymous set with timeout flag Phil Sutter RHEL-32971 RHEL-30082 CVE-2024-26642 - netfilter: nftables: mark set as dea...

kernel security, bug fix, and enhancement update

4.18.0-553.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

UBUNTU-CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

Authorization

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

CVE-2022-3793: Undefined Security Weakness

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

`rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...