517 matches found
Denial of service
HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking...
CVE-2021-32074
HashiCorp vault-action (Vault GitHub Action) prior to version 2.2.0 is affected. Affected component: vault-action, which fails to correctly register multi-line secrets for GitHub Actions log masking, enabling potential disclosure of sensitive information from logs. Remediation: upgrade to vault-a...
Vault GitHub Action Did Not Correctly Mask Multi-Line Secrets In Output
Summary The Vault GitHub Action, vault-action or vault-secrets “vault-action”, did not correctly mask multi-line secrets in its output. This vulnerability, CVE-2021-32074, was fixed in vault-action 2.2.0. Background The Vault GitHub Action, vault-action...
Command Injection
awssamcli is vulnerable to command injection. An attacker is able to inject an arbitrary shell command into the bash script via the title of public GitHub pull request in 'prtitle.yml' , triggering some workflows with limited repository token with no access to secrets or running its own code in t...
Tfsec - Security Scanner For Your Terraform Code
tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform v0.12+ support. Example Output Installation Install with brew/linuxbrew: brew install tfsec Install with Chocolatey: choco install tfsec You can also grab the binary for your system from t...
CVE-2020-14188
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue...
CVE-2020-14189
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment...
CVE-2020-14188
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue...
Code injection
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment...
Code injection
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue...
CVE-2020-14189
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment...
CVE-2020-14188
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue...
CVE-2020-14188
The CVE-2020-14188 issue affects the Atlassian gajira-create GitHub Action prior to version 2.0.1. The exposed flaw, originating in the preprocessArgs function, enables an attacker to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. A patch ex...
PT-2020-13920 · Atlassian · Gajira-Create Github Action
Name of the Vulnerable Software and Affected Versions: Atlassian gajira-create GitHub Action versions prior to 2.0.1 Description: The issue allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. This is due to a problem in...
CVE-2020-15272
In the git-tag-annotation-action open source GitHub Action before version 1.0.1, an attacker can execute arbitrary shell commands if they can control the value of the tag input or manage to alter the value of the GITHUBREF environment variable. The problem has been patched in version 1.0.1. If yo...
CVE-2020-15272
The CVE-2020-15272 entry concerns the git-tag-annotation-action (open source GitHub Action) prior to version 1.0.1. Affected logic allows an attacker to execute arbitrary shell commands if they control the tag input or can alter the GITHUB_REF environment variable. The issue is patched in version...
