RHEA-2024:7866 Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.16.0 release

Bulletin has no description...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: spicedb, mage, q, git-lfs, prometheus-mysqld-exporter, kube-state-metrics-fips, gotenberg, gostatsd, boring-registry, runc, wave-fips, caddy, prometheus-statsd-exporter, step-ca-fips, logstash-exporter-fips, go-bindata, flyte, external-secrets-fips,...

The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure

Learn how Wiz for ASPM extends security to developer infrastructure by continuously enforcing secure defaults and detecting threats across the software supply chain...

Malicious code in kubeflow-pipelines (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48fb3f0a2da611129fdadc65a4bb98ea67f4427bf3f7707de95c4b80ccb8eb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-199 Malicious code in kubeflow-pipelines (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48fb3f0a2da611129fdadc65a4bb98ea67f4427bf3f7707de95c4b80ccb8eb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-CJGQ-5QMW-RCJ6 vulnerabilities

Vulnerabilities for packages: py3-keras, kubeflow-pipelines-visualization-server...

CVE-2024-55459 vulnerabilities

Vulnerabilities for packages: py3-keras, kubeflow-pipelines-visualization-server...

CVE-2024-52798 vulnerabilities

Vulnerabilities for packages: thingsboard, kubeflow-pipelines, argo-workflows, grafana-image-renderer, kubeflow-centraldashboard, sqlpad, tileserver-gl...

GHSA-RHX6-C78J-4Q9W vulnerabilities

Vulnerabilities for packages: thingsboard, kubeflow-pipelines, argo-workflows, grafana-image-renderer, kubeflow-centraldashboard, sqlpad, tileserver-gl...

CVE-2024-10220 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kubernetes-dns-node-cache, aws-efs-csi-driver-fips, aws-efs-csi-driver, nodetaint, kubernetes-dns-node-cache-fips, argocd-image-updater, local-static-provisioner, ip-masq-agent, k8s-device-plugin, rancher-webhook-fips, local-static-provisioner-fip...

CVE-2024-52804 vulnerabilities

Vulnerabilities for packages: py3-tornado, airflow, dask-gateway, kubeflow-pipelines-visualization-server...

GO-2024-3278 Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines

Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582

Cachi2 (open source CLI) is affected up to version 0.13.x; when an unhandled exception occurs, the tool logs function locals, potentially exposing secrets in CI/build logs. Version 0.14.0 includes a patch to fix this. No other exploit details are provided in the documents. Remediation: upgrade to...

CVE-2024-49767 vulnerabilities

Vulnerabilities for packages: airflow-core, emissary, kubeflow-volumes-web-app, mlflow, py3-werkzeug, superset, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, airflow...

BIT-GITLAB-2024-9164 Missing Authentication for Critical Function in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches...

CVE-2024-9164 Missing Authentication for Critical Function in GitLab

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches...

CVE-2024-9164

Removed by vendor...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab versions 12.5 up to and including...