CVE-2025-3048

After completing a build with AWS Serverless Application Model Command Line Interface SAM CLI which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outsid...

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

Impact The APIExport Virtual Workspace can be used to manage objects in workspaces that bind that APIExport for resources defined in the APIExport or specified and accepted via permission claims. This allows an API provider via their APIExport scoped down access to workspaces of API consumers to...

GHSA-VM32-9RQF-RH3R pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

Summary pnpm seems to mishandle overrides and global cache: 1. Overrides from one workspace leak into npm metadata saved in global cache 2. npm metadata from global cache affects other workspaces 3. installs by default don't revalidate the data including on first lockfile generation This can make...

CVE-2024-53866

The CVE-2024-53866 entry concerns pnpm before 9.15.0, where overrides from one workspace can leak into npm metadata stored in global cache, and global-cache data can affect other workspaces. This undermines global state integrity and can enable arbitrary code execution on installs, even when igno...

Unlocking Google Workspace Security: Are You Doing Enough to Protect Your Data?

Google Workspace has quickly become the productivity backbone for businesses worldwide, offering an all-in-one suite with email, cloud storage and collaboration tools. This single-platform approach makes it easy for teams to connect and work efficiently, no matter where they are, enabling seamles...

Worldwide 2023 Email Phishing Statistics and Examples

Explore the need for going beyond built-in Microsoft 365 and Google Workspace™ security based on email threats detected in 2023...

[SECURITY] [DLA 3827-1] plasma-workspace security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3827-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 14, 2024 https://wiki.debian.org/LTS -...

CVE-2024-0435 User can submit message to self-XSS

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS rende...

HashiCorp Terraform 安全漏洞

HashiCorp Terraform is an open source tool for provisioning and managing cloud infrastructures from HashiCorp, USA. A security vulnerability exists in Terraform Enterprise prior to version v202207-1 that stems from not properly enforcing authorization rules for agent pools, which could result in ...

Remote Code Execution

github.com/gitpod-io/gitpod is vulnerable to Remote Code Execution. The vulnerability exists due to cross-site WebSocket Hijacking because the Origin header is not restricted which allows an attacker to take over a workspace with stolen credentials or and extract data from a workplace...

Improper Control of a Resource Through its Lifetime in Mattermost

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels...

8x8 Bounty: jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpoints

An improper access control vulnerability was discovered in jaas.8x8.vc, where removed users could still have READ/WRITE access to the workspace via different API endpoints, if they were logged in and saved their session cookies. The issue was resolved by fixing the session management...

PT-2019-11761 · Jenkins · Jenkins Google Kubernetes Engine Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Google Kubernetes Engine Plugin versions 0.6.2 and earlier Description: The issue concerns the creation of a temporary file containing a temporary access token in the project workspace, which could be accessed by users with Job/Read...