MAL-2022-1902 Malicious code in ci-rush (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb6d8f7b795ca0d5515eb144050231098eb25d663b08cf9b2662228db4d26490 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ci-rush (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb6d8f7b795ca0d5515eb144050231098eb25d663b08cf9b2662228db4d26490 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

What the New OWASP Top 10 Changes Mean to You?

The Open Web Application Security Project OWASP recently updated its top 10 list of the most critical security risks to web applications after 4 years. It represents the most radical shake up since the list was introduced in 2003. The changes will undoubtedly have a big impact on how businesses...

Unpatched Travis CI API Bug Exposes Thousands of Secret User Access Tokens

An unpatched security issue in the Travis CI API has left tens of thousands of developers' user tokens exposed to potential attacks, effectively allowing threat actors to breach cloud infrastructures, make unauthorized code changes, and initiate supply chain attacks. "More than 770 million logs o...

08cms (=1.0.0), 18a58t9c-upload (>=1.0.0 <=1.0.3) +3452 more potentially affected by CVE-2022-25851 via jpeg-js (>=0.0.1 <=0.4.3)

jpeg-js NPM version =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =0.0.2, =0.0.1, =0.0.3, =1.0.0, =0.0.2, =2.2.1, =3.4.7 - @lan/uni-libs =0.0.3 and more Source cves: CVE-2022-25851 Source advisory: OSV:GHSA-XVF7-4V9Q-58W6...

CentOS 8 : nodejs:16 (CESA-2022:4796)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:4796 advisory. - npm: npm ci succeeds when package-lock.json doesn't match package.json CVE-2021-43616 Note that Nessus has not tested for this issue but has instead relied on...

GHSA-485Q-V457-3P58 Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

GHSA-9R3H-WM3X-V245 RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin

ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to provide YAML input files to ElasticBox Jenkins Kubernetes CI/CD...

Exposure of Sensitive Information in Gradle publish plugin

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Credentials transmitted in plain text by Skytap Cloud CI Plugin

Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by...

GHSA-Q2WV-M3PQ-XPV9 Credentials transmitted in plain text by Skytap Cloud CI Plugin

Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by...

GHSA-VX6R-W45X-Q3H6 Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery

A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Note: Jenkins has suspended...

Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Note: Jenkins has suspended distribution of this plugin...

GHSA-7JF5-P556-75PR Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Note: Jenkins has suspended distribution of this plugin...

Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery

A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Note: Jenkins has suspended...

Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Note: Jenkins h...

GHSA-HCH9-6QRJ-5F49 Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Note: Jenkins h...

GHSA-R9XC-54CQ-99R7 Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...