Code injection

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-24619

CVE-2023-24619 affects Redpanda prior to 22.3.12. The rpk import feature logs AWS credentials (Access Key ID and Secret) in cleartext to stdout, exposing them locally or in Kubernetes logs. Fixed in 22.3.12, with related patched versions 22.2.10 and 22.1.12. The vulnerability’s impact is plaintex...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2022-23506

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

Design/Logic Flaw

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-23506

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-23506: Insertion of Sensitive Information into Log File

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

CVE-2022-22998

Implemented protections on AWS credentials that were not properly protected...

Design/Logic Flaw

Implemented protections on AWS credentials that were not properly protected...

U.S. Dept Of Defense: SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]

Summary: I found that it is possible to inject a javascript payload during the PDF form creation process, which is then executed by the checklist application server. Vulnerable Software: Functional Administrative Support Tool FAST v1.0 Intro: ██████████ Administrative clerks create a dynamic acti...

Malicious Package

pygrata-utils is a malicious package. The library attempts to harvest and upload the AWS credentials, network interface information and environment variables to a remote endpoint: "hxxp://graph.pygrata.com:8000/upload."...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.15), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +10 more potentially affected by CVE-2021-21625 via org.jenkins-ci.plugins:aws-credentials (>=1.9, <=1.24)

org.jenkins-ci.plugins:aws-credentials MAVEN version =1.9, =0.1.0, =1.0, =1.0-beta-1, =1.0-beta-1, =0.3, =1.2.2, =1.0.0, =1.32, =1.40 - org.jenkins-ci.plugins:jobcacher 1.0 Source cves: CVE-2021-21625 Source advisory: OSV:GHSA-JWR9-H4JM-C9CH...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.15), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +10 more potentially affected by CVE-2021-21625 via org.jenkins-ci.plugins:aws-credentials (>=1.9, <=1.24)

org.jenkins-ci.plugins:aws-credentials MAVEN version =1.9, =0.1.0, =1.0, =1.0-beta-1, =1.0-beta-1, =0.3, =1.2.2, =1.0.0, =1.32, =1.40 - org.jenkins-ci.plugins:jobcacher 1.0 Source cves: CVE-2021-21625 Source advisory: GHSA-JWR9-H4JM-C9CH...

GHSA-JWR9-H4JM-C9CH Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs

CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed: - Amazon...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.5, <=0.5.1), com.piketec.jenkins.plugins:piketec-tpt (>=6.4, <=8.8) +36 more potentially affected by CVE-2020-2222 via org.jenkins-ci.main:jenkins-core (1.625.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.5, =6.4, =2.4.3, =2.4.3,...