Malicious code in gradle-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2250213d706eee1473dafe9b75172ac8e22adbf885bf28e4b2b85270de1ffbc8 The package gradle-plugin was found to contain malicious code. Source: ghsa-malware 0d6c8dc0207f1992c957598d80609ff61b750f041d94dde7984a3e0a6133d54e...

MAL-2026-221 Malicious code in gradle-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2250213d706eee1473dafe9b75172ac8e22adbf885bf28e4b2b85270de1ffbc8 The package gradle-plugin was found to contain malicious code. Source: ghsa-malware 0d6c8dc0207f1992c957598d80609ff61b750f041d94dde7984a3e0a6133d54e...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

EUVD-2021-0678

Malware in sbrugna...

EUVD-2023-3004

Malicious code in bioql PyPI...

EUVD-2023-2118

Malicious code in bioql PyPI...

EUVD-2022-3634

Malicious code in bioql PyPI...

CVE-2023-39152

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked i.e., replaced with asterisks in the build log in some circumstances...

CVE-2021-21361

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...

Linux Distros Unpatched Vulnerability : CVE-2019-16370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has th...

OS Command Injection

snyk-gradle-plugin is vulnerable to OS Command Injection. The vulnerability is due to the Snyk CLI's failure to correctly sanitize or validate the current working directory name, allowing for potential code injection when running scans on untrusted projects...

GHSA-QQQW-GM93-QF6M OS Command Injection in Snyk gradle plugin

The Snyk gradle plugin is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects...

Code Injection

Overview snyk-gradle-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for Gradle projects. Affected versions of this package are vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrust...

SBOM support in Spring Boot 3.3

Spring Boot 3.3.0 has been released, and it contains support for SBOMs. SBOM stands for "Software Bill of Materials" and describes the components used to build a software artifact. In the context of this blog post, that's your Spring Boot application. These SBOMs are useful because they describe...

The vulnerability of the Gradle plugin for the Quarkus Java framework, which allows a hacker to exploit and disclose protected information

The vulnerability of the Gradle plugin for the Quarkus Java framework is related to the disclosure of information through environment variables. Exploiting this vulnerability allows an attacker to disclose the protected information...

Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

CVE-2023-5720

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

CVE-2023-5720

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

Design/Logic Flaw

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

CVE-2023-5720

CVE-2023-5720 affects Quarkus and describes an information disclosure risk stemming from improper sanitization of artifacts created via the Gradle plugin. The flaw allows access to potentially sensitive build-system information embedded in the application. Connected sources reiterate the same vul...