PT-2024-22351 · Vela · Vela

Name of the Vulnerable Software and Affected Versions: Vela versions prior to 0.23.2 Description: Vela pipelines can use variable substitution combined with insensitive fields like parameters, image, and entrypoint to inject secrets into a plugin/image and bypass log masking, exposing secrets...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: rook, sops, kubescape, gitsign, skopeo, spire-server, step-ca, rabbitmq-messaging-topology-operator, gomplate, ko, kubernetes-dashboard, weaviate, grpc-health-probe, dgraph, guac, minio, slsa-verifier, temporal-ui-server, frp, tkn, kargo, cosign, kube-rbac-proxy,...

CVE-2024-28110 vulnerabilities

Vulnerabilities for packages: falcosidekick, falcosidekick-fips, guac...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: falcosidekick, falcosidekick-fips, guac...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: guac, falcosidekick...

CVE-2024-28152

A flaw was found in jenkins-2-plugins. Multibranch Pipelines with a Bitbucket branch source can be configured to discover pull requests from forks. The trust policy is set to "Forks in the same account" by default. In Bitbucket Branch Source Plugin 866.vdea7dcd3008e and earlier, except...

BIT-GITLAB-2020-10979

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

BIT-GITLAB-2020-13351

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...

BIT-GITLAB-2021-22248

Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only...

BIT-GITLAB-2022-1460

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a...

BIT-GITLAB-2022-3759

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child...

BIT-GITLAB-2023-5106 Incorrect Authorization in GitLab

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

Important: composer

Issue Overview: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead...

GHSA-6VQW-3V5J-54X4 vulnerabilities

Vulnerabilities for packages: ggshield, kubeflow-pipelines, mitmproxy, py3-cassandra-medusa, py3-cryptography, az...

GHSA-6VQW-3V5J-54X4 vulnerabilities

Vulnerabilities for packages: mitmproxy, request-1276, py3-cryptography, az, py3-cassandra-medusa, kubeflow-pipelines, ggshield...

CVE-2024-26130 vulnerabilities

Vulnerabilities for packages: ggshield, kubeflow-pipelines, mitmproxy, py3-cassandra-medusa, py3-cryptography, az...

CVE-2024-26130 vulnerabilities

Vulnerabilities for packages: mitmproxy, request-1276, py3-cryptography, az, py3-cassandra-medusa, kubeflow-pipelines, ggshield...

jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin

A flaw was found in the script-security Jenkins Plugin. In affected versions of the script-security plugin, property assignments performed implicitly by the Groovy language runtime when invoking map constructors were not intercepted by the sandbox. This vulnerability allows attackers with...

CVE-2024-24821

Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local...

FreeBSD : Composer -- Code execution and possible privilege escalation (33ba2241-c68e-11ee-9ef3-001999f8d30b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 33ba2241-c68e-11ee-9ef3-001999f8d30b advisory. - Composer is a dependency Manager for the PHP language. In affected versions several files within the...