4431 matches found
GHSA-723P-9RCJ-XV8J RCE vulnerability in RadarGun Plugin
RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to configure RadarGun Plugin’s build step. RadarGun Plugin 1.8 configures its YAML parser to only...
GHSA-WF76-QGQQ-GCFJ RCE vulnerability in Google Kubernetes Engine Plugin
Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to provide YAML input files to Google Kubernetes Engine Plugin’s build step. Google...
RCE vulnerability in Google Kubernetes Engine Plugin
Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to provide YAML input files to Google Kubernetes Engine Plugin’s build step. Google...
GHSA-VWQ9-CMQR-3C8C Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked i.e. replaced with asterisks in that log to prevent accidental disclosure. Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the...
Symlink Attack
github.com/argoproj/argo-cd is vulnerable to symlink attack. The vulnerability exists due to a lack of sufficient check if the application target directory contains plain Kubernetes YAML manifests allowing out-of-bound manifests and JSON files to leak from Argo CD repo-server...
CVE-2022-29215
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...
Design/Logic Flaw
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...
CVE-2022-29215 Argument Injection in RegionProtect
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...
CVE-2022-29215 Argument Injection in RegionProtect
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...
CVE-2022-29215 Argument Injection in RegionProtect
RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a...
CVE-2022-29215
CVE-2022-29215 affects the RegionProtect plugin. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash when passed arguments do not match. Version 1.1.0 includes a patch for this issue. As a workaround, restrict operator permissions to untrusted use...
CVE-2022-28995
Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...
CVE-2022-28995
Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...
Remote code execution
Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...
CVE-2022-28995
CVE-2022-28995 affects Rengine v1.0.2. The vulnerability enables remote code execution via the YAML configuration function. The issue is confirmed across multiple sources (NVD, Red Hat, OSV, etc.). Practical impact is remote code execution with network access and no authentication required, as de...
CVE-2022-28995
Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...
CVE-2022-28995
Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...
Denial Of Service (DoS)
gopkg.in/yaml.v3 is vulnerable to denial of service. The vulnerability exists when the deserializing input data through the unmarshal function of yaml.go, allowing an attacker to crash the application by providing invalid YAML data...