10491 matches found
CVE-2022-1901
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview...
Code injection
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview...
CVE-2022-1901
CVE-2022-1901 affects Octopus Deploy. The issue allows unmasking of sensitive variables via the variable preview feature in affected versions. Public details in the provided documents are limited to the vulnerability description and a linked advisory; no explicit exploit paths, impacted versions,...
CVE-2022-1901
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview...
Red Hat Enterprise Linux information leakage vulnerability
Red Hat Enterprise Linux is a Linux operating system from Red Hat, Inc. for enterprise users. A security vulnerability exists in Red Hat Enterprise Linux 7 that stems from the inclusion of an incorrect version of podman, which could allow an attacker to access sensitive information stored in...
Octopus Deploy information leakage vulnerability
Octopus Deploy is an automation tool for .NET, Java, and other application development and deployment from Octopus Deploy Australia. An information disclosure vulnerability exists in Octopus Deploy that stems from the exposure of sensitive variables...
CVE-2022-1901: Improper Privilege Management
In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview...
PT-2022-14180 · Unknown · Octopus Deploy
Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows sensitive variables to be unmasked by utilizing the variable preview feature in affected versions of the software. Recommendations: At the moment, there is no...
@actions/core has Delimiter Injection Vulnerability in exportVariable
Impact The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the GITHUBENV file may cause the path or other environment variables to be...
Qualys Cloud Agent log information leakage vulnerability
Qualys Cloud Agent is a lightweight application from Qualys USA, Inc. A single agent for real-time, global visibility and response. A log message disclosure vulnerability exists in Qualys Cloud Agent version 4.8.0-49 that originates from accidentally writing credentials from environment variables...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...
Analyzing the Hidden Danger of Environment Variables for Keeping Secrets
While DevOps practitioners use environment variables to regularly keep secrets in applications, these could be conveniently abused by cybercriminals for their malicious activities, as our analysis shows...
Design/Logic Flaw
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...
[H1] Some admins functions are unusable because of misuse of variables in upgradeable contracts
Lines of code Vulnerability details Impact Admin functions in NFTCollectionFactor.sol are unusable through a proxy Proof of Concept Upgradeable contracts cannot use neither constructors nor use immutable variables. The reason for that is they work behind a proxy which calls them using...
CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...
Monero: Reentrancy attack in eth-monero atomic swap
A reentrancy vulnerability was found in the eth-xmr atomic swap smart contract, allowing an attacker to drain almost all of the ethers from the smart contract. The vulnerability was fixed in a later version of the smart contract...
PT-2022-23055 · Github · @Actions/Core
Name of the Vulnerable Software and Affected Versions: @actions/core versions prior to v1.9.1 Description: The core.exportVariable function uses a well-known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that writ...
USN-5182-1: Roundcube Webmail vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting XSS attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM...
[H1] MIMOProxy can be PWNED by malicious delegate call
Lines of code Vulnerability details Impact PBR proxy owner change protection can bypassed / DoS PoC PRBProxy has a protection to prevent malicious delegatecall to overwrite owner. function executeaddress target, bytes calldata data public payable override returns bytes memory response ... ... //...
