CVE-2023-40034 Repositoty takeover in woodpecker-ci

Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...

CVE-2023-40034 Repositoty takeover in woodpecker-ci

Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a for...

CVE-2023-40034

CVE-2023-40034 affects Woodpecker CI (community fork of Drone CI). The vulnerability: attackers can post malformed webhook data to trigger repository data updates, potentially allowing takeover of a repository when the CI is public and connected to a public forge. The issue is addressed in versio...

Malicious code in nequi-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48d27c14149e644219b408d1a24d84b1434d32c4d0d398bf4037d3321b078c38 The OpenSSF Package Analysis project identified 'nequi-ci-utils' @ 0.2.4 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1246 Malicious code in nequi-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48d27c14149e644219b408d1a24d84b1434d32c4d0d398bf4037d3321b078c38 The OpenSSF Package Analysis project identified 'nequi-ci-utils' @ 0.2.4 npm as malicious. It is considered malicious because: - The package...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability allows an attackers in private projects to view CI/CD analytics...

Incorrect Authorization

gitlab is vulnerable to Incorrect Authorization. This allows a group maintainer to modify the group CI/CD variables resulting in a authorization issue...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because a user with the role of developer could use the import project feature to leak CI/CD variables...

7 Container Security Best Practices For Better Apps

Explore how to implement 7 container security best practices within a CI/CD pipeline built with tools from Amazon Web Services AWS...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs...

Remote Code Execution (RCE)

gitlab is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the improper access control in the CI/CD cache mechanism of the library, which allows an attacker with developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches...

Improper Input Validation

gitlab is vulnerable to Improper input validation. A remote attacker with developer privileges is able to read protected group or project CI/CD variables by importing a malicious project...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. An attacker might use a forged CI job artifact zip file in a project that employs dynamic child pipelines to cause a sidekiq task to use a large amount of RAM. This may result in a Denial of Service on GitLab instances where Sidekiq is...

Information Disclosure

twisted is vulnerable to Information Disclosure. Missing filtering of an error message exposes sensitive information to authenticated attackers, when an include directive fails in the CI/CD configuration...

The vulnerability in the auth_pic.cgi script of the D-Link DI-7500G-CI router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the authpic.cgi microprogramming system of D-Link DI-7500G-CI routers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially created HTML page...

GHSA-5V46-54VJ-4MJQ Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

Jenkins ElasticBox CI Plugin missing permission check

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

CVE-2023-37964

A cross-site request forgery CSRF vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-37965

A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...