CVE-2023-39348 Improper log output when using GitHub Status Notifications in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log...

PT-2023-14311 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.6.10 SUSE Rancher versions prior to 2.7.1 Description: A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the...

Malware Attack on CircleCI Engineer's Laptop Leads to Recent Security Incident

DevOps platform CircleCI on Friday disclosed that unidentified threat actors compromised an employee's laptop and leveraged malware to steal their two-factor authentication-backed credentials to breach the company's systems and data last month. The CI/CD service CircleCI said the "sophisticated...

CVE-2022-46156 Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information

The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token...

Cloudflare Public Bug Bounty: A malicious actor could rotate tokens of a victim, given that he knows the victim's token ID

API tokens of Cloudflare users were vulnerable to unauthorized rotation by malicious actors who knew the victim's token ID due to lack of proper authorization checks. This could lead to DoS for the token owner and the applications that use it. The vulnerability was fixed by enforcing proper acces...

Session Fixation

clearance is vulnerable to session fixation attacks. These attacks are possible because the CSRF token is not rotated on sign in...

drchrono: Security Issue : CSRF Token Design Flaw

Introduction: Hello I am Bruin, a security researcher and analyst. I have been able to identify a bypass in your CSRF protection mechanism, which upon a successful execution can result in a successful CSRF attack on a victim's account. Description: CSRF Token's are different from session ID'S in ...