11474 matches found
Information Disclosure
github.com/containers/podman is vulnerable to information disclosure. The vulnerability is due to data written to RUN --mount=type=bind mounts during the Podman build not being discarded, which allows an attacker to access files created within the container from the host system’s temporary build...
CVE-2025-43431
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption...
[SECURITY] Fedora 42 Update: python-uv-build-0.9.5-1.fc42
This package is a slimmed down version of uv containing only the build backend...
[SECURITY] Fedora 41 Update: python-uv-build-0.9.5-1.fc41
This package is a slimmed down version of uv containing only the build backend...
Characterizing Build Compromises through Vulnerability Disclosure Analysis
The software build process transforms source code into deployable artifacts, representing a critical yet vulnerable stage in software development. Build infrastructure security poses unique challenges: the complexity of multi-component systems source code, dependencies, build tools, the difficult...
Fedora 42 : openapi-python-client / python-uv-build / ruff / etc (2025-a77c1f005b)
The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-a77c1f005b advisory. uv 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for...
Exploit for CVE-2024-7387
overview cve-2024-7387https://nvd.nist.gov/vuln/detail/C...
Exploit for CVE-2024-7387
overview cve-2024-7387https://nvd.nist.gov/vuln/detail/C...
Malicious code in epic-fortnite-build (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bba7791618c9fd4cc17f357dcb22ec2541afaceaa77c10b3c2c41da844d9205 The package epic-fortnite-build was found to contain malicious code...
EUVD-2025-37148
Malicious code in epic-fortnite-build npm...
MAL-2025-49145 Malicious code in epic-fortnite-build (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bba7791618c9fd4cc17f357dcb22ec2541afaceaa77c10b3c2c41da844d9205 The package epic-fortnite-build was found to contain malicious code...
Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont
This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.62.0: Release notes:...
CVE-2025-64144
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...
CVE-2025-64132
Jenkins MCP Server Plugin 0.84.v50ca24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access...
CVE-2025-61234
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port...
EUVD-2025-36691
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port...
CVE-2025-61234
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port...
GHSA-MRPQ-9JR3-RQQ9 Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools
Jenkins MCP Server Plugin 0.84.v50ca24ef83f2 and earlier does not perform permission checks in several MCP tools. This allows to do the following: - Attackers with Item/Read permission can obtain information about the configured SCM in a job despite lacking Item/Extended Read permission getJobScm...
Cleartext Transmission of Sensitive Information
Overview io.jenkins.plugins:byteguard-build-actions is a ByteGuard adds a human verification step to your most consequential scripts. We use a mechanism similar to multifactor authentication for soliciting approval from team members before a function executes. This functionality can be used to...