Malicious code in webhooks-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d68b3caaa081ec90df236d4a158aff4d6771d98222ffa60184401d4a39c71989 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7097 Malicious code in webhooks-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d68b3caaa081ec90df236d4a158aff4d6771d98222ffa60184401d4a39c71989 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mattermost Server is vulnerable to webhook and slash command manipulation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the rest.AnonymousClientConfig method that does not effectively clear service account credentials loaded using rest.InClusterConfig. An attacker can gain...

CVE-2022-30956

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads...

GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution

Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...

Improper kubeconfig validation allows arbitrary code execution

Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...

GHSA-FG3X-RWQ9-74CW Gogs and Gitea SSRF Vulnerability

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

Gogs and Gitea SSRF Vulnerability

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

Server-Side Request Forgery (SSRF)

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services...

Malware Builder Leverages Discord Webhooks

On April 23rd, 2022, a Discord user with the handle “Portu” began advertising a new password-stealing malware builder. Malware builders are programs which so-called script kiddie hackers can craft their own executables on top of. Script kiddie is cybersecurity parlance for a novice hacker who use...

CVE-2022-24817

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

CVE-2022-24817

The CVE-2022-24817 entry applies to Flux2 components: Flux2 itself (versions 0.1.0–0.29.0), helm-controller (0.1.0–v0.19.0), and kustomize-controller (0.1.0–v0.23.0). The root cause is Code Injection via malicious kubeconfig, enabling arbitrary code execution; in multi-tenant deployments it can a...

CVE-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

CVE-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

Mattermost Playbooks plugin denial of service vulnerability

A denial-of-service vulnerability exists in Mattermost Playbooks plugin version 1.24.0 and earlier, which stems from a limit on the number of webhooks that are not properly checked, and can be exploited by an authenticated attacker to trigger a denial of service by creating a specially drafted...

Denial of service

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service...

CVE-2022-1333 A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service...

Mattermost 安全漏洞

A denial-of-service vulnerability exists in Mattermost Playbooks plugin version 1.24.0 and earlier, which stems from a limit on the number of webhooks that are not properly checked, and can be exploited by an authenticated attacker to trigger a denial of service by creating a specially drafted...

FULL read SSRF

Description there is two bypass method for previous fixes of SSRF in gogs The first is to utilize SSRF attack with a DNS rebinding feature. The second is to use redirection to a localhost URL. Proof of Concept 1- go to the webhooks section and create a gogs webhook. 2- enter an URL that redirects...