517 matches found
Malicious code in github-action-benchmark (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f873a3ef25b833c6a1b1d4b8d5079265a195382dc4dbbfda249bcf9ae8d20c8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3371 Malicious code in github-action-benchmark (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f873a3ef25b833c6a1b1d4b8d5079265a195382dc4dbbfda249bcf9ae8d20c8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2343 Malicious code in datadog-agent-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9002ec7ae8e71f521014b440d4e81aea944c0c36aca8f9cd4c01bd5e609626cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in datadog-synthetics-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb7d5c2b8247d500672b7c1089217058c98f072aa33d33e0f42bb0711fab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6814 Malicious code in upload-dsyms-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 643101696c68ab35b338173627e1f0f644c2dd2f6f601b11a9ab324d5549a1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2353 Malicious code in datadog-synthetics-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb7d5c2b8247d500672b7c1089217058c98f072aa33d33e0f42bb0711fab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in upload-dsyms-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 643101696c68ab35b338173627e1f0f644c2dd2f6f601b11a9ab324d5549a1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-29220
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
Design/Logic Flaw
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
CVE-2022-29220
CVE-2022-29220 concerns the github-action-merge-dependabot GitHub Action. Prior to version 3.2.0, it does not verify that commits created by dependabot are signed with the correct GPG key; it only checks that the PR actor is dependabot[bot]. This enables a threat actor with access to the pipeline...
CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
github-action-merge-dependabot 数据伪造问题漏洞
github-action-merge-dependabot is used to automatically approve and merge dependabot PRs. A security vulnerability exists in github-action-merge-dependabot versions prior to 3.2.0, which stems from the fact that it does not check whether commits created by dependabot are verified with the correct...
Vault GitHub Action did not correctly mask multi-line secrets in output
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. The vault-action implementation did not correctly handle the marking of...
GHSA-4MGV-M5CM-F9H7 Vault GitHub Action did not correctly mask multi-line secrets in output
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. The vault-action implementation did not correctly handle the marking of...
CVE-2021-32724
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...
CVE-2021-32724
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...
CVE-2021-32724
CVE-2021-32724 affects the GitHub Action check-spelling (check-spelling/check-spelling). In workflows that run on pull_request_target or schedule, a crafted PR can cause exposure of the GITHUB_TOKEN, enabling the attacker to push commits with repository-level access and potentially exfiltrate sec...
CVE-2021-32724 check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack
check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...
CVE-2021-32074
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...