Fern Pattern Scanner

Fern 模式扫描器 欢迎使用 Fern 的模式扫描器。该扫描器会扫描你建议的文件，并使用 正则表达式 查找 rules/rules.yaml 中规定的任何模式。然后生成一份包含所有发现的报告。本项目用于展示如何将自定义 安全扫描器集成到 GitLab，并用于填充 流水线安全选项卡、漏洞报告 和 合并请求小部件 注意 ：访问漏洞报告需要 GitLab Ultimate 订阅 将扫描器添加到你的 GitLab CI/CD 流水线 你可以通过将以下内容添加到你的 .gitlab-ci.yml 来激活此安全扫描器： root@kitploit: include: - remote:...

GitLeaks

GitLeaks GitLab CI 组件 一个用于 Gitleaks 的 GitLab CI 组件 —— 一款用于检测和防止硬编码秘密（如密码、API 密钥和令牌）被提交到 git 仓库的 SAST 工具。 功能特性 秘密检测 ：扫描仓库中的硬编码秘密和敏感信息 全面规则集 ：包含大量内置规则，用于检测各类秘密 自定义配置 ：支持本地和远程配置文件 多种输出格式 ：支持 JSON、SARIF 及其他报告格式 灵活参数 ：可直接向 Gitleaks 传递附加标志 远程配置 ：从远程 URL 下载并使用配置文件 可配置作业设置 ：可自定义作业名称、阶段和容器镜像 使用方法 基本用法...

trivy

Trivy GitLab CI 组件 一个面向 Trivy 的 GitLab CI 组件——Trivy 是一款全功能安全扫描器，涵盖容器镜像、文件系统、仓库、Kubernetes 集群、SBOM 以及许可证合规性。将这些模板直接插入你的流水线，即可获得可重复的扫描、GitLab 原生报告以及便携式工件，几乎无需编写 Shell 脚本。 功能特性 完整覆盖面 ：容器、文件系统、根文件系统、Git 仓库、虚拟机、SBOM、Kubernetes 集群等。 多扫描器 ：漏洞、错误配置/IaC、密钥和许可证扫描，每个作业均可控制。 GitLab 报告 ：输出容器扫描、JUnit、SARIF 和...

GitLeaks

GitLeaks 容器镜像 针对本地工作流和流水线中秘密扫描的定制化 gitleaks 构建。 特性 从标记的上游源码构建 gitleaks，并固定 Go 工具链以生成可复现的二进制文件。 GitLab CI 组件位于 niclas-zone/ci/gitleaks。 使用 拉取镜像 root@kitploit: podman pull registry.gitlab.com/niclas-zone/ctr/gitleaks:latest 运行扫描 root@kitploit: podman run --rm \ -v $pwd:/repo \ -w /repo ...

CVE-2025-1677

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

EUVD-2019-15045

Malware in sbrugna...

EUVD-2020-5548

Malware in sbrugna...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-13003

An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-503.14.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Oracle Linux 9 : kernel (ELSA-2024-3306)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3306 advisory. - netfilter: nftables: disallow anonymous set with timeout flag Phil Sutter RHEL-32971 RHEL-30082 CVE-2024-26642 - netfilter: nftables: mark set as dea...

kernel security, bug fix, and enhancement update

4.18.0-553.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

UBUNTU-CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

Authorization

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

`rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

GHSA-7PWQ-F4PQ-78GM `rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

RUSTSEC-2022-0042 malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...