417 matches found
Types for Vela Insecure Variable Substitution
Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...
CVE-2024-28236
Vela CVE-2024-28236 describes insecure variable substitution in Vela’s pipelines (go-vela/worker) where substitution into fields such as parameters, image, and entrypoint can leak secrets by bypassing log masking. The issue arises when secrets are injected into a plugin/image and inadvertently pr...
PT-2024-22351 · Vela · Vela
Name of the Vulnerable Software and Affected Versions: Vela versions prior to 0.23.2 Description: Vela pipelines can use variable substitution combined with insensitive fields like parameters, image, and entrypoint to inject secrets into a plugin/image and bypass log masking, exposing secrets...
CVE-2019-25210
An issue was discovered in Cloud Native Computing Foundation CNCF Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was...
CVE-2024-23840 `goreleaser release --debug` shows secrets
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0...
MAL-2024-703 Malicious code in wlwz-2312-5902 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4983584ac611c393e81df819cf9a99ac76b3efe4d53e86cad6af5b1711614fa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-537 Malicious code in wlwz-2312-4007 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1012ed29c688b8a597368227f0b63126a05b4afd997537940bd02d98501fa51e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in d5-es6-sass-boilerplate (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3090df994b516cfc30ee58cc5871282f61ebc4e378a73744fb779705e16a1a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-30262 · Phlox · Simple Http Server Plus +1
Name of the Vulnerable Software and Affected Versions: Phlox com.phlox.simpleserver aka Simple HTTP Server version 1.8 com.phlox.simpleserver.plus aka Simple HTTP Server PLUS version 1.8.1-plus Description: The issue is related to a hardcoded encryption key, specifically aKySWb2jjrr4dzkYXczKRt7K,...
K06110200: BIG-IP and BIG-IQ TACACS+ audit log vulnerability CVE-2023-43485
Security Advisory Description When TACACS+ audit forwarding is configured on a BIG-IP or BIG-IQ system, shared secret is logged in plaintext in the audit log. CVE-2023-43485 Impact An authenticated attacker with at least auditor role privileges can view shared secret. There is no data plane...
SUSE CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
Croc may expose secret to local users
An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments...
GHSA-7G3V-4GGR-XVJF Croc may expose secret to local users
An issue was discovered in Croc before 9.6.16. The shared secret, located on a command line, can be read by local users who list all processes and their arguments...
PT-2023-28882 · Croc · Croc
Name of the Vulnerable Software and Affected Versions: Croc versions prior to 9.6.16 Description: An issue was discovered in Croc where the shared secret, located on a command line, can be read by local users who list all processes and their arguments. Recommendations: For Croc versions prior to...
PT-2023-27223 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.6.15 Argo CD versions prior to 2.7.14 Argo CD versions prior to 2.8.3 Description: Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD...
MAL-2023-1271 Malicious code in proofing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4f14f43198ca513e826ec04070bdebd29c55c4a628a9388c794b5d8a862dd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Octopus Deploy 安全漏洞
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy that stems from the ability to use the variable preview feature to uncover the secrets of variables...
CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets
Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...