CVE-2021-32862 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-9JMQ-RX5F-8JWQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2022-2498

An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author...

CVE-2022-2498

Removed by vendor...

[SECURITY] Fedora 35 Update: golang-github-apache-beam-2-2.33.0~RC1-7.fc35

Apache Beam is a unified model for defining both batch and streaming data-parallel processing pipelines, as well as a set of language-specific SDKs for constructing pipelines and Runners for executing them on distributed processing backends, including Apache Flink, Apache Spark, Google Cloud...

GitLab: RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)

Summary The DecompressedArchiveSizeValidator is used to check the size of a archive before extracting it: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.1.0-ee/lib/gitlab/importexport/decompressedarchivesizevalidator.rbL82 ruby def command "gzip -dc @archivepath | wc -c" end def validate pgrp =...

CVE-2022-34177

Jenkins Pipeline: Input Step Plugin 448.v37cea9a10a70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers...

Malicious code in pipelines-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8899971ffea385fe69c7db3bf9b9aa93bd739ba707bd4641667df007940cf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5343 Malicious code in pipelines-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8899971ffea385fe69c7db3bf9b9aa93bd739ba707bd4641667df007940cf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in snyk-azure-pipelines-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1415763e729b09889f3cb0714d88b936b6c14f499ccbdd82f5697fe861fcc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6194 Malicious code in snyk-azure-pipelines-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1415763e729b09889f3cb0714d88b936b6c14f499ccbdd82f5697fe861fcc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-Q874-G24W-4Q9G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-Q874-G24W-4Q9G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

Update now!  Microsoft patches Follina, and many other security updates

The June 2022 Patch Tuesday may go down in history as the day that Follina got patched, but there was a host of other important updates. And not just from Microsoft. Many other software vendors follow the pattern of monthly updates set by the people in Redmond. Microsoft Microsoft released update...

CVE-2022-29241 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2022-29241 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

MAL-2022-1362 Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Uncover Rust Supply Chain Attack Targeting Cloud CI Pipelines

A case of software supply chain attack has been observed in the Rust programming language's crate registry that leveraged typosquatting techniques to publish a rogue library containing malware. Cybersecurity firm SentinelOne dubbed the attack "CrateDepression." Typosquatting attacks take place wh...

GitLab 9.2 < 14.8.6 / 14.9 < 14.9.4 / 14.10 < 14.10.1 (CVE-2022-1460)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab wa...