CVE-2023-37944

A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2022-3018

An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, cert-exporter, newrelic-fluent-bit-output, pulumi-language-java, pulumi-language-yaml, paranoia, gitness, yam, direnv, goreleaser, newrelic-infrastructure-agent, cni-plugins, kyverno-policy-reporter-kyverno-plugin, envoy-ratelimit,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, timoni, cert-exporter, newrelic-fluent-bit-output, pulumi-language-java, pulumi-language-yaml, paranoia, gitness, yam, direnv, goreleaser, newrelic-infrastructure-agent, cni-plugins, kyverno-policy-reporter-kyverno-plugin, envoy-ratelimit,...

Doppler announces integration with Datadog to streamline security and monitoring

San Francisco, United States / California, 30th January 2025, CyberNewsWire...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

GHSA-5VVG-PVHP-HV2M vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-49750 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: policy-controller, opa, conftest-fips, policy-controller-fips, spire-server, kyverno, conftest, tfsec, zot, spire-server-fips, cosign-fips, zarf, snyk-cli, cosign, kots, kyverno-fips, kubescape, k8sgpt...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: spire-server, kubescape, k8sgpt, conftest, snyk-cli, zarf, zot, cosign, policy-controller, tfsec, opa, kots...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: spire-server, kubescape, k8sgpt, conftest, snyk-cli, zarf, zot, cosign, policy-controller, tfsec, opa, kots...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-655)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-655 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann...

Trojanized jQuery Packages Found on npm, GitHub, and jsDelivr Code Repositories

Unknown threat actors have been found propagating trojanized versions of jQuery on npm, GitHub, and jsDelivr in what appears to be an instance of a "complex and persistent" supply chain attack. "This attack stands out due to the high variability across packages," Phylum said in an analysis...

GHSA-248V-346W-9CWC vulnerabilities

Vulnerabilities for packages: kubeflow-katib, kubeflow-pipelines-visualization-server, k8s-sidecar, superset, kubeflow-jupyter-web-app, kubeflow-pipelines, request-1276, confluent-docker-utils, dask-gateway, py3-certifi, kubeflow-volumes-web-app, barman, py3-torchvision-cuda-11.8, jwt-tool,...

GHSA-MH55-GQVF-XFWM vulnerabilities

Vulnerabilities for packages: rekor, timestamp-authority, prometheus-alertmanager, grafana-mimir, cortex, fulcio...

CVE-2024-39689 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, kubeflow-pipelines-visualization-server, k8s-sidecar, superset, kubeflow-jupyter-web-app, kubeflow-pipelines, request-1276, confluent-docker-utils, dask-gateway, py3-certifi, kubeflow-volumes-web-app, barman, py3-torchvision-cuda-11.8, jwt-tool,...

CVE-2024-38525

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...