CVE-2025-68284

CVE-2025-68284 concerns the Linux kernel, specifically the libceph authentication path in handle_auth_session_key(). The issue arises from the len field originating from untrusted network packets, enabling potential out-of-bounds writes during decryption of the connection secret or during process...

ejson2env 操作系统命令注入漏洞

ejson2env is a Shopify open source tool for decrypting EJSON secrets and exporting them as environment variables. An operating system command injection vulnerability exists in ejson2env versions prior to 2.0.8, which stems from insufficient output cleanup and could lead to command injection...

Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method...