Debian dsa-6434 : lemonldap-ng - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6434 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/securit...

UBUNTU-CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

Malicious code in monty-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d234eb20e94a8d34b23f4aed0a562eb1c038ce5bd603856546c970152a70ac5 On npm install, the package's postinstall hook package.json declares "postinstall": "node bin/cli.js" automatically runs a data-collection CLI withou...

CVE-2021-32638

Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead ...

PT-2021-19822

Name of the Vulnerable Software and Affected Versions CodeQL runner affected versions not specified Description The CodeQL runner previously suggested passing a GitHub token as a command-line parameter, making it visible to other processes on the same machine. This approach can expose the GitHub...

CVE-2021-32638: Exposure of Sensitive Information to an Unauthorized Actor

Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead ...

Nextcloud: nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets

Summary: CircleCI allows projects to configure whether builds will run as a result of a pull request from a fork, and also whether these fork PRs have access to the secrets stored in the parent repo's CircleCI settings. When both settings are enabled, and the repo associated with the project allo...