CVE-2021-21361

The CVE-2021-21361 entry concerns the Gradle plugin com.bmuschko:gradle-vagrant-plugin, which exposes an information disclosure vulnerability by logging system environment variables when the plugin runs in public CI/CD environments. Affected component: the GDKExternalProcessExecutor.groovy flow a...

GHSA-JPCM-4485-69P7 Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Impact The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. Patch...

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Impact The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. Patch...

Cross-site Scripting (XSS)

github.com/argoproj/argo-cd is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via a malicious error message...

Security Bulletin: IBM MQ Appliance is affected by libxslt vulnerabilities (CVE-2019-11068, CVE-2019-18197)

Summary IBM MQ Appliance has resolved libxslt vulnerabilities. Vulnerability Details CVEID: CVE-2019-11068 DESCRIPTION: libxslt could allow a remote attacker to bypass security restrictions, caused by a flaw in the xsltCheckRead and xsltCheckWrite routines. By sending a specially-crafted request,...

CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

CVE-2021-23347

CVE-2021-23347 affects the Argo CD project, specifically the command line interface in the package github.com/argoproj/argo-cd/cmd before 1.7.13, and in 1.8.0 up to before 1.8.6. The underlying issue is a Cross-site Scripting (XSS) vulnerability triggered when the SSO provider returns a malicious...

CVE-2021-23347 Cross-site Scripting (XSS)

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

PT-2021-15451 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: argo-cd versions prior to 1.7.13 argo-cd versions 1.8.0 through 1.8.6 Description: The issue is related to Cross-site Scripting XSS where a malicious SSO provider connected to Argo CD could send back a malicious error message containing...

argo-cd 跨站脚本漏洞

GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. github.com/argoproj/argo-cd/cmd A cross-site scripting vulnerability exists, which stems from the fact that SSO providers connecting to Argo CD will have to send malicious error...

CVE-2021-25281

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheelasync client. Thus, an attacker can remotely run any wheel modules on the master...

Security Bulletin: IBM Cloud Private is vulnerable to Go vulnerabilities (CVE-2021-3114, CVE-2021-3115)

Summary IBM Cloud Private is vulnerable to Go vulnerabilities Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector. CVSS Base score: 4 CVSS Temporal Score...

Security Bulletin: IBM Cloud Private is vulnerable to a Java vulnerability (CVE-2020-14782)

Summary IBM Cloud Private is vulnerable to a Java vulnerability Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and...

Security Bulletin: IBM Cloud Private is vulnerable to etcd vulnerabilities (CVE-2020-15106, CVE-2020-15112, CVE-2020-15113)

Summary IBM Cloud Private is vulnerable to etcd vulnerabilities Vulnerability Details CVEID: CVE-2020-15106 DESCRIPTION: etcd is vulnerable to a denial of service, caused by improper data validation in the decodeRecord method. By sending a specially crafted data, a remote authenticated attacker...

Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)

Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...

CVE-2020-4931

IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-Force ID: 191747...

CVE-2020-4931

IBM MQ AMQP Channels in IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD are affected by a vulnerability that allows an authenticated user to trigger a denial-of-service by processing messages incorrectly. The issue is addressed under APAR IT34485, with fixes/updates available per product version: IBM MQ v8 (...

Everything You Need to Know About Evolving Threat of Ransomware

The cybersecurity world is constantly evolving to new forms of threats and vulnerabilities. But ransomware proves to be a different animal—most destructive, persistent, notoriously challenging to prevent, and is showing no signs of slowing down. Falling victim to a ransomware attack can cause...

Horusec - An Open Source Tool That Improves Identification Of Vulnerabilities In Your Project With Just One Command

Horusec is an open source tool that performs static code analysis to identify security flaws during the development process. Currently, the languages for analysis are: C, Java, Kotlin, Python, Ruby, Golang, Terraform, Javascript, Typescript, Kubernetes, PHP, C, HTML, JSON, Dart. The tool has...