Exposure of secrets through system log in Jenkins Structs Plugin

Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their execution. When Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may...

CVE-2024-39458

When Jenkins Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log...

CVE-2024-39458

When Jenkins Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log...

CVE-2024-39458

When Jenkins Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log...

CVE-2024-39458

When Jenkins Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secrets passed as step parameters, potentially resulting in accidental exposure of secrets through the default system log...

PT-2024-4650 · Jenkins · Jenkins Structs Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Structs Plugin versions 337.v1b 04ea 4df7c8 and earlier Description: The issue is related to the accidental exposure of secrets through the default system log when the Jenkins Structs Plugin fails to configure a build step. This happe...

PT-2024-19166 · Rancher · Rancher Rke1

Name of the Vulnerable Software and Affected Versions: Rancher RKE1 versions 2.7.0 through 2.7.13 Rancher RKE1 versions 2.8.0 through 2.8.4 Description: A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When...

MAL-2024-1602 Malicious code in zwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d55b817c75eb4e4cbea58f640b87c52fd65b16657f129f68a7fb53a604fde7f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1584 Malicious code in portfolio-organism-adp-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41eb756462a90039b0df22968214c17f7b6bbf6a4aaf0db84da2266a6e33813d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1452 Malicious code in @juiggitea/molestias-quo-nihil-modi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9460ce6b7a5e9c2646ba5c2a4dff77162e5267b476b027f8fcd99d70eb18c156 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1426 Malicious code in @juiggitea/dolorum-temporibus-ipsam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79ac2488be1040c18e2f07a682c17be3f26d6ce4b26b9908ae78e6055878eef1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1346 Malicious code in jhsdfgghsdfjhds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15cdbadc3c6de57d6cd2d2cb0a8aa99320ed82d13978c3a2667183e8c04f416a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-25948 · Unknown · Filecodebox

Name of the Vulnerable Software and Affected Versions: FileCodeBox version 2.0 Description: The issue concerns the storage of sensitive information in cleartext. Specifically, FileCodeBox stores a OneDrive password and an AWS key in a cleartext env file. This poses a significant risk as it could...

MAL-2024-1121 Malicious code in packagerandomattackertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf42b61bc6d1d4768731c33802583275971ebe6621404ad29aee53fb653a666a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-V8MX-HP2Q-GW85 Golang SDK for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-69P4-J5V5-X234 Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-7V38-W32M-WX4M Types for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-PWX5-6WXG-PX5H Insecure Variable Substitution in Vela

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

CVE-2024-28236

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...