com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +4 more potentially affected by CVE-2018-1000015 via org.jenkins-ci.plugins.workflow:workflow-durable-task-step (1.13)

org.jenkins-ci.plugins.workflow:workflow-durable-task-step MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-durable-task-step and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta,...

GitHub Says Recent Attack Involving Stolen OAuth Tokens Was "Highly Targeted"

Cloud-based code hosting platform GitHub described the recent attack campaign involving the abuse of OAuth access tokens issued to Heroku and Travis CI as "highly targeted" in nature. "This pattern of behavior suggests the attacker was only listing organizations in order to identify accounts to...

buildbot-gitea (>=1.4.0, <=1.8.0), buildbot-mattermost-reporter (0.2.0) +8 more potentially affected by CVE-2009-2967 via buildbot (4.3.0)

buildbot PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on buildbot and may be impacted: - buildbot-gitea =1.4.0, =17.7.1, =0.6.2, =2.7.0, =3.7.0, =4.0.4 - ursabot 0.1.0 Source cves: CVE-2009-2967 Source advisory: OSV:GHSA-MJ3X-WPRP-MV...

buildbot-gitea (>=1.4.0, <=1.8.0), buildbot-mattermost-reporter (0.2.0) +8 more potentially affected by CVE-2009-2959 via buildbot (4.3.0)

buildbot PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on buildbot and may be impacted: - buildbot-gitea =1.4.0, =17.7.1, =0.6.2, =2.7.0, =3.7.0, =4.0.4 - ursabot 0.1.0 Source cves: CVE-2009-2959 Source advisory: OSV:GHSA-JQQH-999X-W2...

Attacker Breach ‘Dozens’ of GitHub Repos Using Stolen OAuth Tokens

GitHub revealed details tied to last week’s incident where hackers, using stolen OAuth tokens, downloaded data from private repositories. “We do not believe the attacker obtained these tokens via a compromise of GitHub or its systems because the tokens in question are not stored by GitHub in thei...

travismanion.org Cross Site Scripting vulnerability OBB-2562833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens

GitHub on Monday noted that it had notified all victims of an attack campaign, which involved an unauthorized party downloading private repository contents by taking advantage of third-party OAuth user tokens maintained by Heroku and Travis CI. "Customers should also continue to monitor Heroku an...

GitHub Says Hackers Breached Dozens of Organizations Using Stolen OAuth Access Tokens

Cloud-based repository hosting service GitHub on Friday revealed that it discovered evidence of an unnamed adversary capitalizing on stolen OAuth user tokens to unauthorizedly download private data from several organizations. "An attacker abused stolen OAuth user tokens issued to two third-party...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +4 more potentially affected by CVE-2022-29047 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.13)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta,...

Travis CI Configuration Detected

Travis CI is a Software as a Service SaaS based continuous integration service used to build and test software projects. By defining a configuration file named .travis.yml in their source code repositories, developers can customize their applications build workflows. When exposed with the web...

org.jenkins-ci.plugins:simple-travis-runner (>=1.0-alpha-1, <=1.0) potentially affected by CVE-2022-25175 via org.jenkins-ci.plugins.workflow:workflow-multibranch (1.13)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-multibranch and may be impacted: - org.jenkins-ci.plugins:simple-travis-runner =1.0-alpha-1...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +4 more potentially affected by CVE-2022-25178 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.13)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta,...

org.jenkins-ci.plugins:simple-travis-runner (>=1.0-alpha-1, <=1.0) potentially affected by CVE-2022-25179 via org.jenkins-ci.plugins.workflow:workflow-multibranch (1.13)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-multibranch and may be impacted: - org.jenkins-ci.plugins:simple-travis-runner =1.0-alpha-1...

Travis CI Flaw Exposes Secrets of Thousands of Open Source Projects

Continuous integration vendor Travis CI has patched a serious security flaw that exposed API keys, access tokens, and credentials, potentially putting organizations that use public source code repositories at risk of further attacks. The issue — tracked as CVE-2021-41077 — concerns unauthorized...

CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

Design/Logic Flaw

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior if .travis.yml has been created locally by a customer, and...

CVE-2021-41077

CVE-2021-41077 concerns a Travis CI vulnerability observed during 2021-09-03 to 2021-09-10, where the activation/build process could cause secret data (e.g., signing keys, credentials, API tokens) to be exposed to unauthorized actors that forked public repositories. The issue stemmed from builds ...