Mail.ru: [app-01.youdrive.club] RCE in CI/CD via dependency confusion

Dependency confusion allowed remote code execution in youdrive CI/CD pipeline as was demonstrated by researcher via creation of public npmjs.com package matching internal dependancy. I've extracted and saved the content of package.json file for further research during investigating the previous...

openSUSE Security Update : wavpack (openSUSE-2021-154)

This update for wavpack fixes the following issues : - Update to version 5.4.0 - CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples bsc1180414 - fixed: disable A32 asm code when building for Apple silicon - fixed: issues with Adobe-style floating-point WAV files - added:...

Security update for wavpack (moderate)

openSUSE Security Update: Security update for wavpack Announcement ID: openSUSE-SU-2021:0154-1 Rating: moderate References: 1091340 1091341 1091342 1091343 1091344 1180414 Cross-References: CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 CVE-2018-19840 CVE-2018-19841...

Security update for wavpack (moderate)

openSUSE Security Update: Security update for wavpack Announcement ID: openSUSE-SU-2021:0153-1 Rating: moderate References: 1091340 1091341 1091342 1091343 1091344 1180414 Cross-References: CVE-2018-10536 CVE-2018-10537 CVE-2018-10538 CVE-2018-10539 CVE-2018-10540 CVE-2018-19840 CVE-2018-19841...

SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)

This update for wavpack fixes the following issues : Update to version 5.4.0 - CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples bsc1180414 - fixed: disable A32 asm code when building for Apple silicon - fixed: issues with Adobe-style floating-point WAV files - added:...

Security update for cobbler (moderate)

openSUSE Security Update: Security update for cobbler Announcement ID: openSUSE-SU-2021:0046-1 Rating: moderate References: 1020376 1029276 1048183 1074594 1075014 1081714 1081739 1090205 1097733 1101670 1104189 1104190 1104287 1105440 1105442 1113747 1128754 1128926 1130658 1134588 1149075 11518...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

Code injection

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

CVE-2020-26294

Vela compiler before version 0.6.1 allows exposure of server configuration via Sprig's env function in templates. The vulnerability affects the Vela server/component and enables an attacker to retrieve configuration information, exposing sensitive data. The issue has been fixed in version 0.6.1; ...

Announcing the General Availability of Container Security in the VMware Carbon Black Cloud

Today, we are excited to announce the first release of Container Security capabilities in the Carbon Black Cloud. Building on our Cloud Workload Protection solution announced at VMworld, our new Container Security offering supports VMware’s Intrinsic Security vision to protect data and applicatio...

Achieve Operational Excellence in Your Cloud Workload

Explore the Operational Excellence pillar of the AWS and Azure Well-Architected Framework and examine best practices and design principles for cloud-based security operations, including CI/CD and risk management...

openSUSE Security Update : buildah (openSUSE-2020-2106)

This update for buildah fixes the following issues : buildah was updated to v1.17.0 bsc1165184 : - Handle cases where other tools mount/unmount containers - overlay.MountReadOnly: support RO overlay mounts - overlay: use fusermount for rootless umounts - overlay: fix umount - Switch default log...

OPENSUSE-SU-2020:2106-1 Security update for buildah

This update for buildah fixes the following issues: buildah was updated to v1.17.0 bsc1165184: Handle cases where other tools mount/unmount containers overlay.MountReadOnly: support RO overlay mounts overlay: use fusermount for rootless umounts overlay: fix umount Switch default log level of...

Internet Bug Bounty: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)

Summary: Build jobs mingw64 | openssl-1.1.1d and mingw32 | openssl-1.0.2u download dependencies from build.openvpn.net and www.oberhumer.comover an insecure channel http, not https and do not check their integrity in any way. This opens the door to person-in-the-middle attacks, whereby an attacke...

Leonidas - Automated Attack Simulation In The Cloud, Complete With Detection Use Cases

Leonidas is a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into: A web API exposing each test case as an...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

pwntools

This is an open-source repository for the pwntools project, a Python library for reverse engineering and exploitation. The repository contains various files and workflows for contributing to the project, including issue templates, pull request templates, and workflows for continuous integration a...

Feds Seize $1B in Bitcoin from Silk Road

The feds have seized its largest stash ever of Bitcoin, originating from the notorious Silk Road underground marketplace. The federal coffers are now $1 billion richer. Silk Road was known for the place to go to broker illegal drugs, murder-for-hire, child pornography and malware – such as passwo...

ci-semi.com Cross Site Scripting vulnerability OBB-1407159

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...