MAL-2024-11942 Malicious code in atlantis-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 094067edee2b5602a50659db017bc266d4d2a8b841374fec88825e3e0dc47816 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45337 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, pulumi-kubernetes-operator, dynamic-localpv-provisioner-fips, crossplane-provider-aws-s3, prometheus-alertmanager, trust-manager, fq, ko-fips, consul-k8s, scorecard, splunk-otel-collector,...

SUSE CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis

Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...

CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009

Atlantis (a self-hosted Golang app that handles Terraform PR webhooks) exposes GitHub credentials in its logs when rotated. The root cause is that credentials (tokens like gh s_…) were written to logs, enabling someone with log access to impersonate Atlantis and perform GitHub actions, potentiall...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

GHSA-GPPM-HQ3P-H4RP Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

Atlantis 日志信息泄露漏洞

Atlantis is a self-hosted golang application from the Atlantis open source. It listens to Terraform pull request events via webhook. Atlantis has a log information disclosure vulnerability that stems from Atlantis logs containing GitHub credentials during rotation. An attacker who could read thes...

PT-2024-35093 · Atlantis · Atlantis

Name of the Vulnerable Software and Affected Versions: Atlantis versions prior to 0.30.0 Description: The issue concerns the exposure of GitHub credentials in Atlantis logs, specifically tokens starting with ghs ..., when they are rotated. This allows an attacker who can read these logs to...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: trillian, docker-credential-gcr, pulumi-kubernetes-operator, confluent-common-docker, wireguard-go, dynamic-localpv-provisioner-fips, atlantis, metacontroller, skopeo, ksops, kyverno-policy-reporter-ui, kustomize, spicedb, http-echo, extism, vault,...

atlantis-rh.fr Cross Site Scripting vulnerability OBB-3867996

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stargate-atlantis-pandora.de Improper Access Control vulnerability OBB-3771475

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

8x8: Unprotected Atlantis Server at https://152.70.█.█

The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: trillian, pulumi-kubernetes-operator, minio, dynamic-localpv-provisioner-fips, atlantis, metacontroller, wireguard-go, kube-logging-logging-operator, flux-kustomize-controller, aws-ebs-csi-driver, kubernetes-dashboard-metrics-scraper, prometheus-alertmanager,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kots, bom, mc, ip-masq-agent, aws-efs-csi-driver, pulumi, kind, pulumi-language-yaml, nginx-stable, secrets-store-csi-driver-provider-gcp, kubescape, dynamic-localpv-provisioner, oauth2-proxy, kubewatch, metrics-server, nats, rqlite, kubevela, envoy-ratelimit,...

atlantisresearch.in Cross Site Scripting vulnerability OBB-3436829

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...