2823 matches found
TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks
Continuous integration and continuous delivery CI/CD misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of...
PT-2024-1295 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 Description: The issue is related to a cross-server request forgery CSRF attack. An attacker can trick an authenticated Argo CD user into loading a web page that contains code to ca...
Low: Red Hat Security Advisory: libarchive security update
An update for libarchive is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
GHSA-9763-4F94-GFCH vulnerabilities
Vulnerabilities for packages: pulumi-language-dotnet, zarf, aactl, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-ec2, pulumi-language-yaml, spire-server-fips, zot, apko, flux, goreleaser, rclone, crossplane-provider-aws-rds, kubevela, skaffold, grype, pulumi-kubernetes-operator,...
GitLab 1.0.2 < 14.8.6 / 14.9.0 < 14.9.4 / 14.10.0 < 14.10.1 (CVE-2022-1423)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0...
Unauthorized Access
GitLab is vulnerable to Unauthorized Access.The vulnerability is caused due to improper access controls. This could allows an attacker to access sensitive information within private projects,configurations, and other confidential data associated with CI/CD jobs...
Information Disclosure
GitLab EE is vulnerable to Information Disclosure.The vulnerability is caused due to improper authorization. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates...
Denial Of Service
gitlab:sid is vulnerable to Denial of Service. The vulnerability due to point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop. it allows an attacker to cause Denial of Service...
cd-dvd.de Improper Access Control vulnerability OBB-3818105
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-46177
IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system. IBM X-Force ID: 269536...
CVE-2023-46177
IBM MQ Appliance (9.3 LTS and 9.3 CD) contains a remote path-traversal vulnerability due to how it handles crafted URL requests, allowing an attacker to view arbitrary files on the system. Affected versions include 9.3 LTS and 9.3 CD prior to the fixes. Remediation: apply IBM MQ Appliance 9.3.0.1...
Security Bulletin: IBM MQ Appliance is affected by multiple Java vulnerabilitites (CVE-2023-22081 and CVE-2023-5676)
Summary IBM MQ Appliance has resolved multiple Java vulnerabilities. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low...
Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines 1.10.6 release and security update
Red Hat OpenShift Pipelines 1.10.6 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...
Virtuozzo Hybrid Infrastructure 6.0 (6.0.0-243)
In this release, Virtuozzo Hybrid Infrastructure provides an upgrade of the Linux distribution, kernel, and toolset packages. This release also contains a range of new features that cover storage performance, object storage, as well as monitoring and alerts. Additionally, this release delivers...
CureIAM - Clean Accounts Over Permissions In GCP Infra At Scale
Clean up of over permissioned IAM accounts on GCP infra in an automated way CureIAM is an easy-to-use, reliable, and performant engine for Least Privilege Principle Enforcement on GCP cloud infra. It enables DevOps and Security team to quickly clean up accounts in GCP infra that have granted...
GHSA-3F2Q-6294-FMQ5 vulnerabilities
Vulnerabilities for packages: argo-events-fips, argo-workflows, melange, snyk-cli, argo-events, flux-notification-controller, pulumi-kubernetes-operator, task...
GHSA-3F2Q-6294-FMQ5 vulnerabilities
Vulnerabilities for packages: melange, argo-workflows, snyk-cli, task, argo-events, flux-notification-controller, pulumi-kubernetes-operator...
CVE-2023-46402 vulnerabilities
Vulnerabilities for packages: melange, argo-workflows, snyk-cli, task, argo-events, flux-notification-controller, pulumi-kubernetes-operator...