HCL Launch和HCL DevOps Deploy 日志信息泄露漏洞

HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...

PT-2025-13204 · Ibm · Ibm Devops Deploy +1

Name of the Vulnerable Software and Affected Versions: IBM UrbanCode Deploy versions 7.1 through 7.1.2.22 IBM UrbanCode Deploy versions 7.2 through 7.2.3.15 IBM UrbanCode Deploy versions 7.3 through 7.3.2.10 IBM DevOps Deploy versions 8.0 through 8.0.1.5 IBM DevOps Deploy versions 8.1 through...

PT-2025-13032 · Hcl · Hcl Devops Deploy +1

Name of the Vulnerable Software and Affected Versions: HCL DevOps Deploy / HCL Launch affected versions not specified Description: The issue concerns the storage of potentially sensitive authentication token information in log files by HCL DevOps Deploy / HCL Launch. This information could be...

PT-2025-13277

Name of the Vulnerable Software and Affected Versions elunez eladmin versions up to 2.7 Description A problematic issue has been found, affecting the function checkFile of the file "/api/deploy/upload". The manipulation of the argument servers leads to deserialization. This issue can be exploited...

CVE-2025-1998: Insertion of Sensitive Information into Log File

IBM UrbanCode Deploy UCD through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores potentially sensitive authentication token information in log files that could be read by a local user...

CVE-2024-56469: Missing Authentication for Critical Function

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1 could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay...

CVE-2025-0273: Insertion of Sensitive Information into Log File

HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user...

IBM UrbanCode Deploy（IBM UCD）和IBM DevOps Deploy 日志信息泄露漏洞

IBM UrbanCode Deploy IBM UCD and IBM DevOps Deploy are both products of International Business Machines IBM, U.S.A. IBM UrbanCode Deploy is a suite of application automation deployment tools. The tool is based on an application deployment automation management information model, and through remot...

CVE-2025-1997: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM UrbanCode Deploy UCD 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentiall...

IBM UrbanCode Deploy（IBM UCD）和IBM DevOps Deploy 安全漏洞

IBM UrbanCode Deploy IBM UCD and IBM DevOps Deploy are both products of International Business Machines IBM.IBM UrbanCode Deploy is a suite of application automation deployment tools. The tool is based on an application deployment automation management information model, and through remote agent...

CVE-2025-0255

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...

CVE-2025-0256

HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function...

Security Bulletin: IBM Urbancode Deploy (UCD) is vulnerable to Insufficiently Protected LDAP Search Credentials ( CVE-2022-40751 )

Summary In certain circumstances, an Administrator user could gain access to previously configured LDAP search credentials used during authentication. Vulnerability Details CVEID:CVE-2022-40751 DESCRIPTION: IBM UrbanCode Deploy UCD 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 throu...

Security Bulletin: Urbancode Deploy is vulnerable to incorrect authorization reading Component Processes ( CVE-2022-35716 )

Summary Component process security checks can sometimes grant read-level access to users that do not have access if the process is owned by a Component Template and an endpoint performs multiple validations. Vulnerability Details CVEID:CVE-2022-35716 DESCRIPTION: IBM UrbanCode Deploy UCD could...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to Insertion of Sensitive Information into Log File vulnerability (CVE-2025-1998)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD stores potentially sensitive authentication token information in log files that could be read by a local user. Vulnerability Details CVEID:CVE-2025-1998 DESCRIPTION: IBM UrbanCode Deploy UCD stores potentially sensitive authentication token...

Malicious code in zimu-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290f844fd48d3682b9fff232fa6d8150d38d19a8553cafb8c7ed003ee0da4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in zimu-deploy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2726 Malicious code in zimu-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290f844fd48d3682b9fff232fa6d8150d38d19a8553cafb8c7ed003ee0da4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Kyverno ignores subjectRegExp and IssuerRegExp

Summary Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Details Kyverno checks only subject and issuer fields when verifying an...

CVE-2025-0255

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements...