11 matches found
cicd-goat
Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...
trajan
Trajan：CI/CD 安全扫描器 Trajan 扫描 CI/CD 流水线中的安全漏洞，这些漏洞常被攻击者用于攻陷软件供应链。它支持 GitHub Actions、GitLab CI、Azure DevOps、Jenkins 和 JFrog。 功能 Trajan 解析工作流 YAML 文件、构建依赖关系图、运行检测插件，并通过内置的攻击能力验证漏洞的可利用性。 跨多个 CI/CD 平台的 32 个检测插件 跨多个 CI/CD 平台的 24 个攻击插件 基于图的污点追踪与门控检测分析 基于浏览器的扫描器（通过 WebAssembly，无需后端） 多阶段攻击链，自动传递上下文 !NOTE...
zizmor
🌈 zizmor zizmor es una herramienta de análisis estático para sistemas CI/CD. Puede encontrar y corregir problemas de seguridad en configuraciones comunes de CI/CD, incluyendo GitHub Actions, Dependabot y pre-commit. Algunas de las cosas que zizmor encuentra: Vulnerabilidades de inyección de...
CICD-Goat-Vapt-Writeup
CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...
CICD-Goat-Vapt-Writeup — Updated!
CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...
zizmor v1.30.0
🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...
Permissive Regular Expression
Overview Affected versions of this package are vulnerable to Permissive Regular Expression in the VerificationPolicy module when matchin refSource.URITekton. An attacker can alter verification modes or keys and potentially compromise the integrity of CI/CD pipelines by supplying resources source...
CVE-2026-24765
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage method, which deserialize...
CVE-2019-25210
An issue was discovered in Cloud Native Computing Foundation CNCF Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was...
How to Protect Your CI/CD Pipeline
Continuous integration and continuous delivery/deployment CI/CD has won over app developers, with enterprise cybersecurity teams on the hook to protect CI/CD pipelines. OWASP’s Top 10 CI/CD Security Risks clarify what to watch for...