GHSA-MXR3-8WHJ-J74R Harden-Runner allows evasion of 'disable-sudo' policy

Summary Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with...

Harden-Runner allows evasion of 'disable-sudo' policy

Summary Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with...

PT-2025-17593 · Xrpl.Js · Xrpl.Js

Name of the Vulnerable Software and Affected Versions: xrpl.js versions 2.14.2, 4.2.1, 4.2.2, 4.2.3, 4.2.4 xrpl.js versions prior to 4.2.5 and 2.14.3 Description: xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. The affected versions of xrpl.j...

PT-2025-17568 · Totolink · Totolink A950Rg +3

Name of the Vulnerable Software and Affected Versions: TOTOLINK A830R version 4.1.2cu.5182 B20201102 TOTOLINK A950RG version 4.1.2cu.5161 B20200903 TOTOLINK A3000RU version 5.9c.5185 B20201128 TOTOLINK A3100R version 4.1.2cu.5247 B20211129 Description: A buffer overflow vulnerability was discover...

PT-2025-17552 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A buffer overflow issue was discovered in the cstecgi.cgi of the TOTOLINK A810R. Recommendations: For version 4.1.2cu.5182 B20201026, as a temporary workaround, consider disabling...

CVE-2025-32955

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to disable-sudo bypass. Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemente...

CVE-2025-32955 Harden-Runner Evasion of 'disable-sudo' policy

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to disable-sudo bypass. Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemente...

CVE-2025-32955

CVE-2025-32955 (Harden-Runner) affects Harden-Runner versions 0.12.0 through 2.11.x, where the disable-sudo policy can be bypassed. The issue arises because the runner user, while removed from sudoers, remains in the docker group and can interact with the Docker daemon to start privileged contain...

CVE-2025-32955 Harden-Runner Evasion of 'disable-sudo' policy

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to disable-sudo bypass. Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemente...

CVE-2025-32955 Harden-Runner Evasion of 'disable-sudo' policy

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to disable-sudo bypass. Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemente...

Harden-Runner 安全漏洞

Harden-Runner is a program open-sourced by StepSecurity. Provides web exit filtering and runtime security for GitHub hosted and self-hosted runners. A security vulnerability exists in Harden-Runner versions prior to 0.12.0 through 2.12.0, which stems from a possible bypass of the disable-sudo...

PT-2025-17462 · Panhainan · Ds-Java

Name of the Vulnerable Software and Affected Versions: panhainan DS-Java version 1.0 Description: A critical issue affects the function uploadUserPic.action of the file src/com/phn/action/FileUpload.java. The manipulation of the argument fileUpload leads to code injection. The attack may be...

PT-2025-17475 · Mrcms +1 · Mrcms +1

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.3 ASUS router affected versions not specified Description: A vulnerability has been found that allows for cross-site scripting through the manipulation of the Username argument in the file /admin/user/edit.do of the Edit Use...

OESA-2025-1440 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

OESA-2025-1439 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

IBM Sterling Connect:Direct Web Services 代码问题漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A code issue vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from a browser closing without disabling the session, no details of the...

CLSA-2025-1744926159 Update of openssl

Backport the implicit rejection mechanism for RSA PKCS1 v1.5 to prevent Bleichenbacher attacks; add an option to disable the mechanism...

CVE-2025-31497

TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity XXE Injection vulnerability in its document conversion functionality. The service processes XML...

SUSE CVE-2025-32433

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...

PT-2025-17213 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10 version V4.0si V16.03.10.20 Description: The issue is related to a Buffer Overflow in AdvSetMacMtuWan via wanMTU2. This allows for potential exploitation. No information is provided about the estimated number of potentially affecte...