CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: temporal-ui-server-fips, thanos, secrets-store-csi-driver-provider-azure, cortex, mc, sigstore-scaffolding-fips, prometheus-elasticsearch-exporter-fips, prometheus-elasticsearch-exporter, argo-workflows, dynamic-localpv-provisioner, pulumi-language-yaml,...

Who is Alleged Medibank Hacker Aleksandr Ermakov?

Authorities in Australia, the United Kingdom and the United States this week levied financial sanctions against a Russian man accused of stealing data on nearly 10 million customers of the Australian health insurance giant Medibank. 33-year-old Aleksandr Ermakov allegedly stole and leaked the...

@aragonite/vbox-runner (>=0.0.1, <=0.0.2), @arisan/streamer2 (>=0.0.0, <=0.1.4) +116 more potentially affected by CVE-2024-21488 via network (>=0.0.12, <=0.6.1)

network NPM version =0.0.12, =0.0.1, =0.0.0, =1.0.0, =1.0.0-alpha-13, =0.0.3, =1.0.0, =0.0.0, =0.0.0, =0.0.0-beta.0, =3.0.0, =0.4.0, =1.0.0, =1.2.11 and more Source cves: CVE-2024-21488 Source advisory: SNYK:JS-NETWORK-6184371...

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

Continuous integration and continuous delivery CI/CD misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: policy-controller, kubevela, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-family-aws, crossplane, crossplane-provider-aws-firehose, gitness, crossplane-provider-aws-kms, flux-kustomize-controller, zot, crossplane-provider-aws-rds,...

GitLab 13.7 < 14.3.4 / 14.4 < 14.4.2 / 14.5 < 14.5.2 (CVE-2021-39939)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from...

CVE-2024-21623 Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "Analysis - SonarCloud" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and...

Potential Actions command injection in output filenames (GHSL-2023-275)

Summary The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. Details The verify-changed-files workflow returns the list of files changed within a workflow execution. This could...

GHSA-MCPH-M25J-8J63 tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)

Summary The tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. Details The changed-files action returns a list of files changed in a commit or pull request which provides an escapejson...

tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)

Summary The tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. Details The changed-files action returns a list of files changed in a commit or pull request which provides an escapejson...

CVE-2023-52137

The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The verify-changed-files workflow returns the list of files changed within a workflow execution. This could potentially allow...

CVE-2023-52137

CVE-2023-52137 affects the tj-actions/verify-changed-files GitHub Action. The vulnerability allows command injection through changed filenames returned by the verify-changed-files workflow, potentially enabling arbitrary code execution on the GitHub Runner and secret leakage when outputs are used...

CVE-2023-52137 GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames

The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The verify-changed-files workflow returns the list of files changed within a workflow execution. This could potentially allow...

CVE-2023-51664 tj-actions/changed-files command injection in output filenames

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrar...

Rhadamanthys Malware: Swiss Army Knife of Information Stealers Emerges

The developers of the information stealer malware known as Rhadamanthys are actively iterating on its features, broadening its information-gathering capabilities and also incorporating a plugin system to make it more customizable. This approach not only transforms it into a threat capable of...

MAL-2023-8637 Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

Malicious code in @terraform-aws-github-runner/aws-ssm-uti (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9e8dee05678c6b03df102e495749bdc9db8ae73a32752a0f85345cc637577012 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-uti' @ 1.999.0 npm as malicious. It is considered maliciou...

Malicious code in test262-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cee87d436e3a799f9c25994010662db61c2e7c3cdcefc4eab8e8d437f38e1755 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kubevela, nri-prometheus, secrets-store-csi-driver-provider-gcp, caddy, src, kubernetes-dashboard, wireguard-go, grpcurl, falcoctl, k3d, prometheus-postgres-exporter, mc, nfs-subdir-external-provisioner-fips, dex, kubernetes-csi-livenessprobe,...