2826 matches found
CVE-2024-41121 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...
PT-2024-5332 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0 through 2.11.6 Argo CD versions 2.7.0 through 2.10.15 Argo CD versions 2.8.0 through 2.9.20 Description: The issue is related to the Argo CD web terminal, which allows users to get a shell inside a running pod. When the...
Exploit for Use of a Broken or Risky Cryptographic Algorithm in Argoproj Argo_Cd
CVE-2024-31989 CVE-Exploit for Argo CD This repository cont...
Malicious code in sap-cd (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b129ce991640a28395649d0743d86a38416052a617e290ac3fbe220ab780351c The OpenSSF Package Analysis project identified 'sap-cd' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...
MAL-2024-7673 Malicious code in sap-cd (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b129ce991640a28395649d0743d86a38416052a617e290ac3fbe220ab780351c The OpenSSF Package Analysis project identified 'sap-cd' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...
GHSA-MH55-GQVF-XFWM vulnerabilities
Vulnerabilities for packages: grafana-mimir, timestamp-authority, fulcio, rekor, prometheus-alertmanager, cortex...
The vulnerability of the ISO 9660 Image File Handler component in the libcdio library allows a hacker to execute arbitrary code.
The vulnerability of the ISO 9660 Image File Handler component in the libcdio library is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2024-35156
IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292766...
CVE-2024-35155
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292765...
GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd
Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd...
GitLab Releases Patch for Critical CI/CD Pipeline Vulnerability and 13 Others
GitLab has released security updates to address 14 security flaws, including one critical vulnerability that could be exploited to run continuous integration and continuous deployment CI/CD pipelines as any user. The weaknesses, which affect GitLab Community Edition CE and Enterprise Edition EE,...
Security Bulletin: IBM MQ is vulnerable to a denial of service attack (CVE-2024-31919)
Summary IBM MQ has addressed a denial of service vulnerability caused by an error processing messages when an API Exit using MQBUFMH is used. Vulnerability Details CVEID:CVE-2024-31919 DESCRIPTION: IBM MQ, in certain configurations, is vulnerable to a denial of service attack caused by an error...
Security Bulletin: IBM MQ is vulnerable to a privilege escalation attack (CVE-2024-31912)
Summary IBM MQ has addressed a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2024-31912 DESCRIPTION: IBM MQ could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. CVSS Base score: 7.5 CVSS Temporal...
Practical Guidance For Securing Your Software Supply Chain
The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who...
Malicious code in updated-tiktok-followers-generator-2023-mfxswe_ahk-cd (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in cd-package-lib (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-6104 vulnerabilities
Vulnerabilities for packages: rabbitmq-messaging-topology-operator, gh, kubevela, pulumi-kubernetes-operator, pulumi, flux-notification-controller, crossplane-provider-family-azure, spire-server-fips, loki, src-fingerprint, crossplane-provider-azure-sql, opentelemetry-collector-contrib-fips,...
BIT-GITLAB-2024-1736 Uncontrolled Resource Consumption in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration...
