GHSA-7R3H-M5J6-3Q42 @actions/core has Delimiter Injection Vulnerability in exportVariable

Impact The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the GITHUBENV file may cause the path or other environment variables to be...

@atlantis-lab/actl (>=0.4.0, <=0.4.37), @atlantis-lab/actl-check (>=0.1.0, <=0.4.37) +62 more potentially affected by CVE-2022-35954 via @actions/core (>=1.0.0, <=1.9.0)

@actions/core NPM version =1.0.0, =0.4.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =2.3.0, =0.1.0, =0.0.0-canary.6527017, =0.0.0-d99f4ac.0, =0.0.5, =2.0.0, =3.5.2, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2022-35954 Source advisory: OSV:GHSA-7R3H-M5J6-3Q42...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

Authorization Bypass

github.com/automationbroker/apb is vulnerable to authorization bypass. The vulnerability exists because the docker container grants all users sudoer permissions which allows an attacker to access the running container and perform unauthorized actions...

CVE-2022-37437

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

CVE-2022-37437

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

Authorization

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

CVE-2022-37437 Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

CVE-2022-37437

Summary: CVE-2022-37437 affects Splunk Enterprise 9.0.0 when using Ingest Actions to configure an S3 destination via Splunk Web. The root cause is that TLS certificate validation is not correctly performed and tested for the destination, and this only impacts connections through Splunk Web with T...

CVE-2022-37437

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

PT-2022-17953 · Unknown · Sequi Portbloque S

Name of the Vulnerable Software and Affected Versions: Sequi PortBloque S affected versions not specified Description: The issue is related to an improper authorization vulnerability. This vulnerability may allow a low-privileged user to perform administrative functions by using specifically...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2022-35954

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

Design/Logic Flaw

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

@actions/core 注入漏洞

@actions/core is the core function of the npm package management tool for individual developers. This function is used for result, key, and log configuration. An injection vulnerability exists in @actions/core 1.9.0 and earlier, which stems from the use of a well-known delimiter in the...

Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Multiple Reflected Cross-Site Scripting

The plugin does not sanitise and escape numerous parameters before outputting them back in admin pages via various AJAX actions, leading to Reflected Cross-Site Scripting PoC With SitePress active, and with more than 1 active language: 6458 being a valid Product ID 16 being valid vendor id...

CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

CVE-2022-35954

The CVE-2022-35954 issue affects the GitHub Actions ToolKit, specifically core.exportVariable in @actions/core. The vulnerability arises from a well-known delimiter (GitHubActionsFileCommandDelimeter ) used to set environment variables via GITHUB_ENV, which can be exploited to break out of the in...

CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...