Malicious code in action-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47502de1954b1ba4d201ac64813edf79362d7f81fb2c28f6802f800d93bc08d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in action-deploy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in cs-deploy-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2024-17172 · Welliamcao · Ops Manager

Name of the Vulnerable Software and Affected Versions: welliamcao OpsManage versions 3.0.1 through 3.0.5 Description: A critical issue affects the deploy host vars function of the /apps/api/views/deploy api.py file in the API Endpoint component. This issue leads to deserialization and can be...

Malicious code in cs-deploy-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc924b01d9d1492c726482e9cfb4985b29cfd9c8771d907af44c2d7351d1ff36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10481 Malicious code in cs-deploy-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc924b01d9d1492c726482e9cfb4985b29cfd9c8771d907af44c2d7351d1ff36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-49770 oak's path traversal allows transfer of hidden files within the served root directory

oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default oak does not allow transferring of hidden files with Context.send API. However, prior to version 17.1.3, this can be bypassed by encoding / as its URL encoded...

hellobluenove (2.0.0), hellowebapp-deploy (1.0.4) +1 more potentially affected by CVE-2024-49769 via waitress (1.1.0)

waitress PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - hellobluenove 2.0.0 - hellowebapp-deploy 1.0.4 - saltdash =0.9.1, =0.9.5 Source cves: CVE-2024-49769 Source advisory: OSV:GHSA-3F84-RPWH-47G6...

PT-2025-2902

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 7.2 through 7.2.3.13 IBM UrbanCode Deploy versions 7.3 through 7.3.2.8 IBM DevOps Deploy versions 8.0 through 8.0.1.3 Description This issue allows a user to embed arbitrary HTML tags in the Web UI, potentially...

BIT-GITLAB-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

GitLab 11.6 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-8970)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

GitLab 11.4 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-5005)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

GitLab 12.5 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-9164)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

CVE-2024-9623

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

UBUNTU-CVE-2024-9623

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623

CVE-2024-9623 affects GitLab CE/EE versions 8.16–17.2.9, 17.3–17.3.5, and 17.4–17.4.2, enabling deploy keys to push to archived repositories. The connected documents confirm the affected ranges and the action (deploy keys abuse), but no explicit root-cause details beyond the described behavior ar...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...