CVE-2022-2228

Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling...

CVE-2022-2228

Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling...

CVE-2022-2228: Undefined Security Weakness

Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling...

PT-2022-15325

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.0 through 14.10.4 GitLab EE versions 15.0 through 15.0.3 GitLab EE versions 15.1 through 15.1.0 Description The issue allows an attacker with the appropriate access tokens to obtain CI variables in a group using IP-based...

kernel security and bug fix update

5.14.0-70.17.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.17.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

org.jenkins-ci.main:jenkins-test-harness (>=1.577, <=1.586), org.jenkins-ci.plugins:bitbucket-build-status-notifier (>=1.2.1, <=1.4.2) +4 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.0)

org.jenkins-ci.plugins:junit MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.main:jenkins-test-harness =1.577, =1.2.1, =1.21, =1.5.0, =0.7.1, =0.7.3 Source cves:...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3) potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.23)

org.jenkins-ci.plugins:junit MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =1.3 Source cves: CVE-2022-34176 Source advisory:...

org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.3, <=0.4) potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.13)

org.jenkins-ci.plugins:junit MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:junit-realtime-test-reporter =0.3, =0.4 Source cves: CVE-2022-34176 Source...

Cross-site Scripting in Jenkins Maven Metadata Plugin

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...

Jenkins Maven Metadata for CI server Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. a cross-site scripting vulnerability exists in Jenkins Maven Metadata for CI...

Cross site scripting

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...

Malicious code in grpc-web-ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11d0af52c7d239f9ff017b274343baedd992ab107a6c5dc25cab2e8fb77c66c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3467 Malicious code in grpc-web-ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11d0af52c7d239f9ff017b274343baedd992ab107a6c5dc25cab2e8fb77c66c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4286 Malicious code in lerna-version-ci-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67233c1de6d3bfa55320e625ad77f86f9b1ddcce7aeee2664eb8151e8fbdf50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ci-rush (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb6d8f7b795ca0d5515eb144050231098eb25d663b08cf9b2662228db4d26490 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1902 Malicious code in ci-rush (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb6d8f7b795ca0d5515eb144050231098eb25d663b08cf9b2662228db4d26490 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

What the New OWASP Top 10 Changes Mean to You?

The Open Web Application Security Project OWASP recently updated its top 10 list of the most critical security risks to web applications after 4 years. It represents the most radical shake up since the list was introduced in 2003. The changes will undoubtedly have a big impact on how businesses...

Unpatched Travis CI API Bug Exposes Thousands of Secret User Access Tokens

An unpatched security issue in the Travis CI API has left tens of thousands of developers' user tokens exposed to potential attacks, effectively allowing threat actors to breach cloud infrastructures, make unauthorized code changes, and initiate supply chain attacks. "More than 770 million logs o...

CentOS 8 : nodejs:16 (CESA-2022:4796)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:4796 advisory. - npm: npm ci succeeds when package-lock.json doesn't match package.json CVE-2021-43616 Note that Nessus has not tested for this issue but has instead relied on...

org.jenkins-ci.plugins:git-tag-message (>=1.0, <=1.5) potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.2.7)

org.jenkins-ci.plugins:git MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-tag-message =1.0, =1.5 Source cves: CVE-2021-21684 Source advisory:...