CVE-2024-8311

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template...

CVE-2024-8311 Improper Protection of Alternate Path in GitLab

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template...

CVE-2024-8311

Removed by vendor...

CVE-2024-8311 Improper Protection of Alternate Path in GitLab

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab EE versions prior to 17.2 to 17.2.5...

Payment Gateway SLIM CD Data Breach: 1.7 Million Users Impacted

The payment gateway platform SLIM CD suffered a massive data breach between August 2023 and June 2024, compromising…...

GitHub Actions Vulnerable to Typosquatting, Exposing Developers to Hidden Malicious Code

Threat actors have long leveraged typosquatting as a means to trick unsuspecting users into visiting malicious websites or downloading booby-trapped software and packages. These attacks typically involve registering domains or packages with names slightly altered from their legitimate counterpart...

IBM MQ 9.1 < 9.1.0.23 LTS / 9.2 < 9.2.0.27 LTS / 9.3 < 9.3.0.21 LTS / 9.3 < 9.4 CD / 9.4 < 9.4.0.5 LTS (7167208)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7167208 advisory. - IBM MQ could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager. CVE-2024-40681 No...

Security Bulletin: IBM MQ Appliance vulnerable to bypassing security restrictions (CVE-2024-40681)

Summary IBM MQ Appliance has addressed a security bypass vulnerablity. Vulnerability Details CVEID:CVE-2024-40681 DESCRIPTION: IBM MQ could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager. CVSS Base score: 7...

Security Bulletin: IBM MQ Appliance is vulnerable to exposure of sensitive information (CVE-2023-5981 and CVE-2024-0533)

Summary IBM MQ Appliance has addressed GNU GnuTLS exposure of sensitive information vulnerabilities. Vulnerability Details CVEID:CVE-2023-5981 DESCRIPTION: GNU GnuTLS could allow a remote attacker to obtain sensitive information, caused by a timing sidechannel issue during RSA-PSK key exchange. B...

GO-2022-0882 Observable Discrepancy in Argo in github.com/argoproj/argo-cd

Observable Discrepancy in Argo in github.com/argoproj/argo-cd...

GO-2022-0869 Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd

Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd...

GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd

Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd...

GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd

Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd...

GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd

Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd...

GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd

Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd...

GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd

DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd...

GO-2022-0499 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd...

GO-2022-0497 Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd

Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd...

GO-2022-0455 Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd

Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd...