PT-2018-5144

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.2.4 Description The issue is related to a lack of input validation in the CI job component, resulting in persistent cross-site scripting. This allows for malicious scripts to be injected and executed,...

PT-2018-5145

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3 Description The issue is related to a path traversal problem in the GitLab CI runner component, which results in remote code execution. Recommendations For Gitlab Community Edition version 10.3, update to ...

CVE-2018-1227: Undefined Security Weakness

Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI concourse-dot-ci open source project has been registered...

PT-2018-11091

Name of the Vulnerable Software and Affected Versions Pivotal Concourse versions after 2018-03-05 Description The issue affects Pivotal Concourse, potentially allowing remote attackers to have an unspecified impact if a customer obtained the software from a DNS domain no longer controlled by...

CVE-2018-1227: Concourse-dot-ci domain issue | Cloud Foundry

Severity High/Advisory Vendor Concourse CI Affected Products and Versions Please see the notice available at https://pivotal.io/security/cve-2018-1227. References https://pivotal.io/security/cve-2018-1227 Description The original domain for the Concourse CI concourse-dot-ci open source project ha...

GSA Bounty: CI for [example.gov] can be logged in and accessible

When anyone searched a public search engine for inurl:example.gov where example.gov was one of the URLs in the TTS Bug Bounty scope, the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in",...

Archery - Open Source Vulnerability Assessment And Management Helps Developers And Pentesters To Perform Scans And Manage Vulnerabilities

Archery is an opensource vulnerability assessment and management tool which helps developers and pentesters to perform scans and manage vulnerabilities. Archery uses popular opensource tools to perform comprehensive scaning for web application and network. It also performs web application dynamic...

PT-2018-4245

Name of the Vulnerable Software and Affected Versions ciborg gem version 3.0.0 Description The issue concerns a /tmp file race condition in the chef/travis-cookbooks/ci environment/perlbrew/recipes/default.rb file of the ciborg gem. This allows a malicious local user to create a symlink attack on...

ci-leman.ch XSS vulnerability

Open Bug Bounty ID: OBB-483506 Description| Value ---|--- Affected Website:| ci-leman.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ci-gate.de XSS vulnerability

Open Bug Bounty ID: OBB-477731 Description| Value ---|--- Affected Website:| ci-gate.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GitLab: GitLab CI runner can read and poison cache of all other projects

The GitLab CI runner allows users to cache files and directories in between runs. These files are stored in a ZIP file and uploaded to a shared cache instance. In my testing, the files were uploaded to runners-cache-4-internal.gitlab.com and runners-cache-3-internal.gitlab.com, even for dedicated...

Richard Seiersen, CISO of Twilio, Joins Wallarm Board of Advisers

We are excited to welcome Richard Seiersen to Wallarm advisory team. Richard brings tons of security experience from both start-ups and global companies and unique views on making the impact of security measurable. We have asked Richard to share some of his thoughts on what’s important in cyber...

Visit Wallarm at AWS re:Invent 2017

Wallarm will present its Application Security solutions at AWS re:Invent in Las Vegas November 27 through December 1st. As a leading provider of AI-driven application security, Wallarm is helping customers running on AWS to implement application security. Wallarm solutions includes high-performan...

Wallarm to sponsor OWASP AppSec USA

If you are a SecOps or DevOps professional you can not miss the application security event of the year: AppSec USA, September 19–22nd at Disney Coronado Spring Resort, Orlando, FL Use the code: UNLM50WLLRM to register to get $50 discount. You will get great information on the new security tools a...

Wallarm at NGINX.conf

Wallarm is proud to be a gold sponsor of NGINX 2017. nginx.conf is an annual conference for technical professionals who are passionate about delivering better application and web performance. The event takes place on September 6–8 at the Nines Luxury Hotel in Portland, OR. Join us at the...

Fedora 26 : tcpreplay (2017-8306577cc7)

Here is what is fixed in this release : - Fix reporting of rates 1Mbps 348 - Option --unique-ip not working properly 346 ---- Features and fixes include : - MAC rewriting capabilities by Pedro Arthur 313 - Fix several issues identified by Coverity 305 - Packet distortion --fuzz-seed option by...

Algolia: SAUCE Access_key and User_name leaked in Travis CI build logs

hello algolia team, I founded the SAUCE AccessKey and Username was leaked in Travis CI build logs of instantsearch.js product Line-249-&-250. This can be used to perform every API calls of sauce-lab.e.g Creating a Sub account. I created a test account for testing. sorry for this ; . You should...

Visual Studio Security Extension: Puma Scan

Visual Studio Security Extension Puma Scan is the leading software security Visual Studio analyzer extension. Built on top of Roslyn, the open-source .NET Compiler Platform, Puma Scan provides real time, continuous source code analysis as development teams write code. Vulnerabilities are...

Multi Purpose DevOps Security Auditing Tool: DevAudit

Multi Purpose DevOps Security Auditing Tool DevAudit is an open-source, cross-platform, multi-purpose security auditing tool targeted at developers and DevOps practitioners that detects security vulnerabilities at multiple levels of the solution stack. DevAudit provides a wide array of auditing...

ci-plus.com XSS vulnerability

Vulnerable URL: http://www.ci-plus.com/index.php?page=download"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4444705 VIP website status:| No Check ci-plus.com SSL connection:...