AtomShields Cli - Security Testing Framework For Repositories And Source Code

AtomShields Cli is a Command-Line Interface to use the software AtomShields Installation pip install atomshieldscli Basic usage ascli --target --name The allowed action values are: install : To install a checker or a report, depending the context setted. uninstall : To uninstall a checker or a...

Unauthorized File Access

node-git-server is vulnerable to unauthorized file access. Attackers are able to access private repositories using absolute paths...

How to Avoid the Top Three Causes of Data Breaches in 2019

What's the price of unprotected IT infrastructure? Cybercrime Magazine says that global damages will surpass $6 billion as soon as 2021. Here we'll go through some of the most frequent and emerging causes of data breaches in 2019 and see how to address them in a timely manner. Misconfigured Cloud...

Remote Code Execution

Sonatype Nexus Repository Manager is vulnerable to remote code execution. An attacker with administrative access to NXRM is able to create repositories that can grant access to read/execute system data outside the scope of NXRM...

Unauthorized File Access

Overview Versions of node-git-server prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories. Recommendation Upgrade to version 0.6.1 or later. References - GitHub PR -...

CVE-2017-15041

An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side...

GHSA-MC84-XR9P-938R High severity vulnerability that affects generator-jhipster

Generated code uses repository configuration that downloads over HTTP instead of HTTPS Impact Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time. Patches Maven users should at least...

CVE-2019-15000

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 the fixed version for 5.16.x , from 6.0.0 before 6.0.10 the fixed version for 6.0.x, from 6.1.0 before 6.1.8 the fixed version for 6.1.x, from 6.2.0 before 6.2.6 the fixed version for 6.2.x, from 6.3.0 before 6.3.5 t...

GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests

I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...

Information Disclosure

jenkins-2-plugins is vulnerable to information disclosure. Missing permission checks in the Pipeline: Shared Groovy Libraries plugin enables an attacker to obtain confidential information about the contents of the SCM repositories that are referenced by global libraries...

Repository 'Used Space' Value Greater Than 'Capacity'

Challenge A Repository listed under Backup Infrastructure Backup Repositories has a 'Used Space' value that is greater than the 'Capacity' of the storage. Cause This occurs when repositories are backed by storage that has the ability to reduce the space used by restore points, like deduplication...

How to Use Multiple Backup Repositories Pointing to a Single Catalyst Store

Product Improvement Starting in Veeam Backup & Replication 13.1, multiple backup repositories sharing a single HPE StoreOnce Catalyst Store can be created, edited, and rescanned directly in the Veeam Backup & Replication Console using the Folder field of the New Backup Repository wizard. For...

NewStart CGSL CORE 5.04 / MAIN 5.04 : golang Multiple Vulnerabilities (NS-SA-2019-0047)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has golang packages installed that are affected by multiple vulnerabilities: - An arbitrary command execution flaw was found in the way Go's go get command handled the checkout of source code repositories. A remote attacker...

CVE-2018-20894

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...

CVE-2018-20894

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...

Design/Logic Flaw

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...

CVE-2018-20894

CVE-2018-20894 affects cPanel prior to 74.0.0, where website contents can be exposed to other local users via Git repositories. Root cause: misconfiguration in Git repositories used by the web-site content handling allows local users to access content that should be restricted. Impact: partial co...

CVE-2018-20894

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...

PT-2019-10324

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 74.0.0 Description: The issue allows web-site contents to be accessible to other local users via Git repositories. Recommendations: For versions prior to 74.0.0, update to version 74.0.0 or later to resolve the issue...

CVE-2018-20894: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories SEC-443...