1985 matches found
Slack private code on GitHub stolen
Online collaboration platform Slack reported on New Year's Eve it had suffered a "security incident" where some of its code stored on GitHub was stolen. According to the post from the company's security team, Slack's private code repositories were accessed using swiped employee tokens. No custome...
[SECURITY] Fedora 36 Update: GitPython-3.1.30-1.fc36
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
CircleCI Urges Customers to Rotate Secrets Following Security Incident
DevOps platform CircleCI on Wednesday urged its customers to rotate all their secrets following an unspecified security incident. The company said an investigation is currently ongoing, but emphasized that "there are no unauthorized actors active in our systems." Additional details are expected t...
JVN#16765254: Multiple code injection vulnerabilities in ruby-git
ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities CWE-94. Impact If a repository containing a specially crafted filename is loaded to the product, an arbitrary ruby code may be executed. Solution...
CVE-2023-22464 ViewVC XSS vulnerability in revision view changed path "copyfrom" locations
ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by a...
[SECURITY] Fedora 37 Update: GitPython-3.1.30-1.fc37
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
Researchers Discover Malicious PyPI Package Posing as SentinelOne SDK to Steal Data
Cybersecurity researchers have discovered a new malicious package on the Python Package Index PyPI repository that impersonates a software development kit SDK for SentinelOne, a major cybersecurity company, as part of a campaign dubbed SentinelSneak. The package, named SentinelOne and now taken...
Octosuite - Advanced Github OSINT Framework
A framework fro gathering osint on GitHub users, repositories and organizations Wiki Refer to the Wiki for installation instructions, in addition to all other documentation. Features Fetches an organization's profile information Fetches an oganization's events Returns an organization's repositori...
GitHub Announces Free Secret Scanning for All Public Repositories
GitHub on Thursday said it is making available its secret scanning service to all public repositories on the code hosting platform for free. "Secret scanning alerts notify you directly about leaked secrets in your code," the company said, adding it's expected to complete the rollout by the end of...
Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages
NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors. "The packages were part of a new attack vector, with attackers spamming the open source ecosystem with packages containing links to phishing...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
Design/Logic Flaw
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
CVE-2022-46827
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible...
PT-2022-27984 · Jetbrains · Intellij Idea
Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3 Description: The issue allows for an XXE attack, which can lead to a Server-Side Request Forgery SSRF via requests to custom plugin repositories. This occurs due to a flaw in handling requests ...
jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client
A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...
Apache Archiva has an unspecified vulnerability (CNVD-2022-78861)
Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote repositories. The software provides remote Repository agents, role-based security access management, and usage reporting.A security vulnerability exists in versions of Apache Archiva prior to 2.2.9,...
CVE-2022-45385
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...
GHSA-5M7G-PJ8W-7593 Vela Insecure Defaults
Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...