CVE-2023-30853

CVE-2023-30853 describes an information disclosure in the Gradle Build Action for GitHub Actions when the configuration cache is enabled in versions prior to 2.4.2. Environment variables passed to Gradle can be persisted into GitHub Actions cache entries, which may be read by untrusted workflows ...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

PT-2023-22078 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.11.16 Cilium versions prior to 1.12.9 Cilium versions prior to 1.13.2 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log t...

CVE-2023-26493 Command Injection in Cocos Engine workflow

Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the web-interface-check.yml was subject to command injection. The web-interface-check.yml was triggered when a pull request was opened or updated and...

MAL-2023-189 Malicious code in cms-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e7660bdda7ac53c4bd35a3b5698ca80b7d2f5bf8bd47a5e7e6163aead683350 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2020-8566

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

SUSE CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

SUSE CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the buildignore list in "galaxy.yml" include files in the .tar.gz file. This contains sensitive info, such as the user's Ansible Galaxy A...

MAL-2023-231 Malicious code in delta-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccf1578d031db527a894c33da7eafd61638d10822d39d19172cb3572d18b72ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-163 Malicious code in cathode-versions-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0e16e7e4327697f795d989d71781e02f4036cfffca1d0dce1e5b9a6f0a54f7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Plugin OSF Builder Suite :: XML Linter 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A code issu...

GHSA-MF4P-WJRM-CMJP AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

S3 Explorer Plugin stores AWSSECRETACCESSKEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the...

MAL-2022-2366 Malicious code in dc-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2dceb4a54732ea88a32914ede9a5ffd5c61c8593fa9ac72465d3f691b8e8f96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2653 Malicious code in ebayui-ads (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ab074972f923b11e148393b0e2759e65eb3b531563049d5b7304d6098384376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3884 Malicious code in internallib_v142 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3d92a298438e29d174c7b3087bb34dfaab7026aaa951c667f852efcce81507d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7384 Malicious code in zero-falhas-vilao (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa015055a70b26945bc855724412fc2102ff5bd2c14f3dc1ec748ddc6be957ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2734 Malicious code in en-task-duedate-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dceb0e887aa838ea4740189eb0143a3f4d731c251862665648424ff2a4e25e72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7344 Malicious code in yeoman-33enerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46467411b04dd7b9a5c0f9063b47e48dcb506330bdcd90899e4e20e48de784e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3698 Malicious code in http-proxy-iddlemare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2f358bcd3dc9d017b753a0661664f92444c3b40db7af4e0a10fe7e9b0cb12d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1190 Malicious code in awodr-wrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b37b691358f802cf42a7236eecfa42f04d42c2c961d085fd8f7ee928f236db11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...