Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.16.4

The 1.16.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.16.4 release of Red Hat OpenShift Pipelines Operator...

Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challenges

The rapid adoption of machine learning ML technologies has driven organizations across diverse sectors to seek efficient and reliable methods to accelerate model development-to-deployment. Machine Learning Operations MLOps has emerged as an integrative approach addressing these requirements by...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.1

The 1.18.1 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.18.1 release of Red Hat OpenShift Pipelines Operator...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2023-28677

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2022-45306

Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder...

CVE-2022-1460

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a...

CVE-2020-13351

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

CVE-2019-15736

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

CVE-2019-15594

GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint...

CVE-2019-15591

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.15.3

The 1.15.3 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.15.3 release of Red Hat OpenShift Pipelines Operator...

I’m done preparing the slides for my talk about Vulristics at PHDays

I 'm done preparing the slides for my talk about Vulristics at PHDays. I'll be speaking on the last day of the festival - Saturday, May 24, at 16:00 in Popov Hall 25. If you're there at that time, I'd be glad to see you. If not - join online! I'll have an hour to dive into Vulristics, vulnerabili...

Malicious code in com.unity.render-pipelines.universal-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e796de3cb6203dc09766f14c46913307a4c760e4cd01047b30993c7ac605648c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-43859 vulnerabilities

Vulnerabilities for packages: mitmproxy, checkov, reflex, jupyter-base-notebook, airflow, kserve, kubeflow-pipelines-visualization-server...

GHSA-VQFR-H8MV-GHFJ vulnerabilities

Vulnerabilities for packages: mitmproxy, checkov, reflex, jupyter-base-notebook, airflow, kserve, kubeflow-pipelines-visualization-server...

The Dark Side of Digital Twins: Adversarial Attacks on AI-Driven Water Forecasting

Digital twins DTs are improving water distribution systems by using real-time data, analytics, and prediction models to optimize operations. This paper presents a DT platform designed for a Spanish water supply network, utilizing Long Short-Term Memory LSTM networks to predict water consumption...

CVE-2025-1568

Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelin...