CVE-2020-13288

CVE-2020-13288 is a stored XSS vulnerability in GitLab’s CI/CD Jobs page affecting versions prior to 13.0.12, 13.1.6, and 13.2.3. Root cause: stored XSS in the Jobs page. Impact: could allow script execution or injection impacting where the Jobs page is viewed. Affected products: GitLab (versions...

CVE-2020-13288

Removed by vendor...

CVE-2020-13288

In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

CVE-2020-2211 affects Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin (versions ≤ 1.3). The root cause is that the YAML parser is not configured to prevent instantiation of arbitrary types, enabling remote code execution. The CVE entry notes a questionable attack surface but does not provide e...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Add Ergonomic Security to Your CI/CD Pipeline

Wikipedia defines ergonomics as “the application of psychological and physiological principles to the engineering and design of products, processes, and systems. The goal … is to reduce human error, increase productivity, and enhance safety and comfort with a specific focus on the interaction...

How to Secure DevOps in Microsoft Azure

Want to establish best practices within Microsoft Azure? Learn how to integrate a Secure DevOps Kit for Azure AzSK at the subscription level, as well as in your development process during coding, CI/CD pipeline, and future alerting and reporting...

Open Doors with Cloud Security Posture Management (CSPM)

Gain insights into the importance of being well-architected during the deployment process and how to quickly remediate risks by shifting best practice checks to the earliest phase of the CI/CD pipeline...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: CI Token Access Control...

Node.js third-party modules: [last-commit-log] Command Injection

I would like to report Command Injection in last-commit-log It allows execution of arbitrary commands Module module name: last-commit-log version: [email protected] npm page: https://www.npmjs.com/package/last-commit-log Module Description Node.js module to get the last git commit information...

Integrate Security Into DevOps and IaC

This article provides recommendations on implementing security into your CI/CD and infrastructure as code pipeline, and most importantly, how to enable both security and DevOps to start speaking each other’s languages...

Protect Your Container Images and CI/CD Pipeline

Ever wonder if the container images you provide to customers have been checked for vulnerabilities, malware, and other malicious threats? Read this article on how to easily and quickly set up protection for your container images and CI/CD pipeline...

GitLab: Stored XSS on the job page

Hello Gitlab! Steps to reproduce: 1. Run Gitlab docker run --detach --hostname gitlab.example.com --publish 443:443 --publish 80:80 --publish 22:22 --name gitlab gitlab/gitlab-ce:latest 2. Create a new project with README.md 3. Go to Operations-Kubernetes 1. Click on the "Add Kubernetes cluster"...

Shift Well-Architecture Left. By Extension, Security Will Follow

A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...

CVE-2020-10979

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

Authentication flaw

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Code injection

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...