CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2018-3983

An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. A specially crafted document can cause an array fetch to return an uninitialized pointer and then performs some arithmetic before writing a value to the result. Usage of this...

Hackers Using E-Crime Tool Atlantis AIO for Credential Stuffing on 140+ Platforms

Threat actors are leveraging an e-crime tool called Atlantis AIO Multi-Checker to automate credential stuffing attacks, according to findings from Abnormal Security. Atlantis AIO "has emerged as a powerful weapon in the cybercriminal arsenal, enabling attackers to test millions of stolen...

Malicious code in atlantis-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 094067edee2b5602a50659db017bc266d4d2a8b841374fec88825e3e0dc47816 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11942 Malicious code in atlantis-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 094067edee2b5602a50659db017bc266d4d2a8b841374fec88825e3e0dc47816 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45337 vulnerabilities

Vulnerabilities for packages: coredns-fips, wavefront-collector-for-kubernetes, goreleaser, prometheus-statsd-exporter-fips, crossplane-provider-aws-iam, buf, crossplane-provider-aws-kinesis, cert-manager-webhook-pdns, cilium, datadog-agent, kyverno-fips, calico-fips, splunk-otel-collector,...

SUSE CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis

Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...

CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009

Atlantis (a self-hosted Golang app that handles Terraform PR webhooks) exposes GitHub credentials in its logs when rotated. The root cause is that credentials (tokens like gh s_…) were written to logs, enabling someone with log access to impersonate Atlantis and perform GitHub actions, potentiall...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

GHSA-GPPM-HQ3P-H4RP Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

PT-2024-35093 · Atlantis · Atlantis

Name of the Vulnerable Software and Affected Versions: Atlantis versions prior to 0.30.0 Description: The issue concerns the exposure of GitHub credentials in Atlantis logs, specifically tokens starting with ghs ..., when they are rotated. This allows an attacker who can read these logs to...

Atlantis 日志信息泄露漏洞

Atlantis is a self-hosted golang application from the Atlantis open source. It listens to Terraform pull request events via webhook. Atlantis has a log information disclosure vulnerability that stems from Atlantis logs containing GitHub credentials during rotation. An attacker who could read thes...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: coredns-fips, wavefront-collector-for-kubernetes, prometheus-statsd-exporter-fips, mage, metacontroller, nri-prometheus, cert-manager-webhook-pdns, cilium, logstash-exporter, wire-go, litefs, hello-world-golang, gobump, prometheus-beat-exporter-fips,...

atlantis-rh.fr Cross Site Scripting vulnerability OBB-3867996

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stargate-atlantis-pandora.de Improper Access Control vulnerability OBB-3771475

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...