Privilege Escalation

jenkins-2-plugins is vulnerable to privilege escalation. The vulnerability exists due to a lack of sanitization of the path allowing an attacker to configure Pipelines permission to read arbitrary files on the Jenkins controller file system...

Large aggregation pipelines with a specific stage can crash mongod under default configuration

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to incorrect authentication, allows a perpetrator to access confidential data.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to incorrect authentication on the pipelines page. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

CVE-2022-1105

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled...

UBUNTU-CVE-2022-1105

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled...

CVE-2022-1105

Removed by vendor...

PT-2022-13663 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.11 through 14.7.6 GitLab CE/EE versions 14.8 through 14.8.4 GitLab CE/EE versions 14.9 through 14.9.1 Description: An issue with access control in GitLab CE/EE allows unauthorized users to access pipeline analytics,...

CVE-2022-25176

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on t...

CVE-2022-25176

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on t...

CVE-2022-25173

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file typically Jenkinsfile for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted...

Atlassian Bitbucket Pipelines Configuration Detected

Bitbucket is a popular Git-based Source Code Management system SCM provided by Atlassian as both a cloud and an on-premise service. Bitbucket Pipelines is an integrated Continuous Integration and Continuous Development CI/CD feature of Bitbucket, offering automatic builds, tests and deployments...

GHSA-PQ7M-3GW7-GQ5X vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-PQ7M-3GW7-GQ5X vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

Dep-Scan - Fully Open-Source Security Audit For Project Dependencies Based On Known Vulnerabilities And Advisories. Supports Both Local Repos And Container Images. Integrates With Various CI Environments Such As Azure Pipelines, CircleCI, Google CloudBuild

dep-scan is a fully open-source security audit tool for project dependencies based on known vulnerabilities, advisories and license limitations. Both local repositories and container images are supported as input. The tool is ideal for CI environments with built-in build breaker logic. If you hav...

CVE-2022-21699 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

bower-cache (=0.5.0), cacahuate (>=3.9.0 <=4.0.0a6) +58 more potentially affected by CVE-2021-23727 via celery (>=3.1.11 <=5.2.1)

celery PYPI version =3.1.11, =3.9.0, =0.0.2, =1.0.1, =0.19.0, =2.0.0a0, =1.0.0, =1.0.24, =0.0.5, =0.0.13, =1.0.18, =1.2.7 and more Source cves: CVE-2021-23727 Source advisory: OSV:GHSA-Q4XR-RC97-M4XX...

Information disclosure

In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure...

GoCD Authentication Vulnerability

GoCD has released a security update to address a critical authentication vulnerability in GoCD versions 20.6.0 through 21.2.0. GoCD is an open-source Continuous Integration and Continuous Delivery system. A remote attacker could exploit this vulnerability to obtain sensitive information. CISA...

Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...

Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...