CVE-2024-43796 vulnerabilities

Vulnerabilities for packages: sqlpad, kubeflow-pipelines, argo-workflows, kubeflow-centraldashboard...

The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to replace the code in imported CI/CD pipelines.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to replace the code in imported CI/CD pipelines...

UBUNTU-CVE-2024-7110

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection...

GHSA-8HC4-VH64-CXMJ vulnerabilities

Vulnerabilities for packages: lerna, airflow, kibana, argo-workflows, kubeflow-centraldashboard, jitsucom-jitsu, kubeflow-pipelines...

CVE-2024-39338 vulnerabilities

Vulnerabilities for packages: lerna, airflow, kibana, argo-workflows, kubeflow-centraldashboard, jitsucom-jitsu, kubeflow-pipelines...

CVE-2024-39338 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, lerna, jitsucom-jitsu, argo-workflows, kubeflow-centraldashboard...

GHSA-HX9V-6R9F-W677 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Impact Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. Patches The problem has been fix...

CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

GHSA-MPG4-RC92-VX8V vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, renovate...

CVE-2024-41818 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, renovate...

Secure Your APIs and Reduce Your Attack Surface With Modern, AI-powered API Security in Qualys Web Application Scanning (WAS)

The rise of APIs presents both opportunities and challenges in today’s hyperconnected digital world. APIs are integral to digital transformation initiatives across industries. The latest data indicates that over 83% of web traffic now comprises API traffic, highlighting their critical role in...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to the Apache Kafka (CVE-2024-27309).

Summary IBM Event Streams is vulnerable to a denial of service attack due to the Apache Kafka. It is primarily used to build real-time streaming data pipelines and applications that adapt to the data streams. It combines messaging, storage, and stream processing to allow storage and analysis of...

jenkins-plugin/script-security: sandbox bypass via sandbox-defined classes

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin within the sandbox-defined classes, enabling the circumvention of security restrictions. This flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protecti...

jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin involving crafted constructor bodies, enabling the circumvention of security restrictions. With crafted constructor bodies, this flaw allows authenticated attackers to define and execute sandboxed scripts, including...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...

GHSA-JFMJ-5V4G-7637 vulnerabilities

Vulnerabilities for packages: checkov, superset, kubeflow-pipelines...

GHSA-JFMJ-5V4G-7637 vulnerabilities

Vulnerabilities for packages: checkov, superset, kubeflow-pipelines...

CVE-2024-5569 vulnerabilities

Vulnerabilities for packages: checkov, superset, kubeflow-pipelines...

CVE-2024-5569 vulnerabilities

Vulnerabilities for packages: checkov, superset, kubeflow-pipelines...

The vulnerability of the Zenml framework for creating machine learning pipelines, related to the incorrect validity period of a session, allows attackers to bypass the authentication process.

The vulnerability of the Zenml machine learning pipeline creation framework is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process...