1013 matches found
Exim 安全漏洞
Exim is an open source messaging agent MTA running on Unix systems that routes, forwards and delivers mail. Exim suffers from a security signature issue vulnerability that stems from the lack of a closed execution flag for privileged pipelines. No detailed vulnerability details are provided at th...
CVE-2021-24105
Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe...
CVE-2021-21293
CVE-2021-21293 concerns blaze-core prior to 0.14.15, where unbounded acceptance of new connections on a dedicated thread pool can exhaust file handles and degrade services. Affected component is blaze-core (used by http4s-blaze-server) with unbounded queues after accept. The fix in 0.14.15 adds a...
Code Injection in tensorflow/tfx
Description TensorFlow Extended TFX is a Google-production-scale machine learning platform based on TensorFlow. It provides a configuration framework to express ML pipelines consisting of TFX components. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of...
PT-2021-4076 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.8 and later Description: The issue is related to the possibility of creating a recursive pipeline relationship, which can lead to a denial of service. This can be exploited by a remote attacker to cause resource...
CVE-2020-8565 vulnerabilities
Vulnerabilities for packages: spark-operator, kubeflow-pipelines, gostatsd, newrelic-nri-statsd...
CVE-2020-8565 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, spark-operator, newrelic-nri-statsd, gostatsd...
CVE-2020-13351
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...
CVE-2020-13351
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...
PT-2020-13492 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 13.3.9 GitLab CE/EE versions 13.4.0 through 13.4.5 GitLab CE/EE versions 13.5.0 through 13.5.2 Description: Insufficient permission checks in the scheduled pipeline API allow an attacker to read variable nam...
SUSE-OU-2020:3291-1 Optional update for python-redis and redis
This optional update for python-redis and redis provides the following fixes python-redis: - Update to version to 3.4.1 jscECO-2417 Move the username argument in the Redis and Connection classes to the end of the argument list. This helps those poor souls that specify all their connection options...
GitLab code issue vulnerability (CNVD-2020-70853)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A code issue vulnerability exists in GitLab CE/EE version...
GitLab: An attacker can run pipeline jobs as arbitrary user
Summary An attacker can run arbitrary pipeline jobs as a victim user. This means the attacker can access the user private repositories, member only repositories, registry, etc... by using the victim CIJOBTOKEN token. This is only my recent research and I wanted to report it as soon as possible. I...
CVE-2020-10979
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...
Authentication flaw
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...
PT-2020-12464 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 11.10 through 12.9 Description: The issue is related to the leaking of information on restricted CI pipelines metrics to unauthorized users. Recommendations: For GitLab EE/CE versions 11.10 through 12.9, update to a...
What are the benefits of SAST testing in CI/CD pipelines?
Static application security testing SAST is traditionally used in software development lifecycles both early on in the process and often to "white box" test all files containing source code. Integrating SAST into modern CI/CD pipelines allows developers to continuously monitor their code, providi...
Adama - Searches For Threat Hunting And Security Analytics
Adama Searches ForThreat Hunting and Security Analytics A collection of known log and / or event data searches for threat hunting and detection. They enumerate sets of searches used across many different data pipelines. Implementation details are for ELK. Adama is part of the SpaceCake project...