CVE-2022-31128

Tuleap CVE-2022-31128 affects Tuleap Community Edition prior to 13.10.99.82 and Tuleap Enterprise Edition prior to 13.10-3. The issue arises from improper verification of fine-grained permissions when creating Git branches via the REST API (POST git/:id/branches); users could create branches rega...

CVE-2022-31128 Fine grained permissions are not checked in Tuleap

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions. Users can create branches via th...

[SECURITY] Fedora 36 Update: skopeo-1.9.0-4.fc36

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

Fedora: Security Advisory for commit-stream (FEDORA-2022-5ef0bd9a27)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious Npm Packages Tapped Again to Target Discord Users

Threat actors once again are using the node package manager npm repository to hide malware that can steal Discord tokens to monitor user sessions and steal data on the popular chat and collaboration platform, researchers have found. A campaign discovered this week by Kaspersky researchers is hidi...

How Organizations Manage to Understand Millions of Unstructured Data Files at Scale

For an ever-growing segment of organizations, making sense of unstructured data is fast becoming imperative. It is also far more challenging. Unlike structured data that’s stored in rows and columns, text-based, and easy to search in relational databases and data warehouses, there is no defined...

CVE-2022-36884

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

CVE-2022-36881

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks...

snyk-broker 路径遍历漏洞

snyk-broker is a proxy program for access between snyk.io and Git repositories. A security vulnerability exists in snyk-broker versions prior to 4.73.0, which stems from the package's susceptibility to directory traversal, and can be exploited by an attacker to access read arbitrary files...

Hackers can spoof commit metadata to create false GitHub repositories

By Deeba Ahmed Checkmarx security researchers have warned about an emerging new supply chain attack tactic involving spoofed metadata commits to present malicious… This is a post from HackRead.com Read the original post: Hackers can spoof commit metadata to create false GitHub repositories...

[SECURITY] Fedora 35 Update: gitjacker-0.0.2-6.fc35

Leak git repositories from misconfigured websites...

[SECURITY] Fedora 35 Update: commit-stream-0.1.2-7.fc35

OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API...

[SECURITY] Fedora 36 Update: skopeo-1.8.0-9.fc36

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

U.S. Dept Of Defense: insecure gitlab repositories at ████████ [HtUS]

If you click the link https://███, you're redirected to https://██████/users/signin, where credentials have to be inserted. The repositories are private and shouldn't be accessable for unauthenticated users! POC If you click the following links https://████/api/v4/projects, information about...

[SECURITY] Fedora 36 Update: commit-stream-0.1.2-7.fc36

OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API...

Why a “Lift-and-shift” Cloud Migration Strategy Doesn’t Support Data Security

The classic 1982 Steven Spielberg horror film “Poltergeist” chronicles disturbing, unexplained paranormal activity happening in a suburban family’s idyllic home. As the activity becomes more sinister and terrifying, the family learns that their neighborhood was built on an old burial ground. It...

CVE-2021-40899

A Regular Expression Denial of Service ReDOS vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories...

CVE-2021-40899

A Regular Expression Denial of Service ReDOS vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories...

Denial of service

A Regular Expression Denial of Service ReDOS vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories...

PT-2022-11327 · Unknown · Repo-Git-Downloader

Name of the Vulnerable Software and Affected Versions: repo-git-downloader version 0.1.1 Description: A Regular Expression Denial of Service ReDOS issue was found in the software when it downloads crafted invalid git repositories. This occurs due to a flaw in how regular expressions are handled,...