GitLab 12.5 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-9164)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

MAL-2024-9230 Malicious code in duckc2-v5.3.6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1787f323cf8287cce75c9f98309dbf5edfb1721a840a920500ec0e0cdb6be06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9229 Malicious code in duckc2-v5.3.5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 375fe67ac59d8abd545809431db7b3e818c78cd1e2d0798eaff2cad2f48069ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9227 Malicious code in duckc2-v5.2.3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 312f10b261529061f06f146485b626f5ac5f86887bd775baa9cc015f430d1e07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9222 Malicious code in duckc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91c8da6dab980dc3b48d5d97fb6494c628bce931b908b10cdaaa4e0659d6dd25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9254 Malicious code in sukuna-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c28070648a48cc88a94d5ad2595df8a698f689504e6dbd8f3800fa2e84f658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9224 Malicious code in duckc2-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b9838006c36dd7525551f1e1b25b9140f9e30f9b644c64619d7735696b986ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9223 Malicious code in duckc2-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ccae9bda706300a8078341f64a00c3eeb0dc539eb2d138274eb7b41487169a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9623

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

UBUNTU-CVE-2024-9623

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

CVE-2024-9623

Removed by vendor...

CVE-2024-9623

CVE-2024-9623 affects GitLab CE/EE versions 8.16–17.2.9, 17.3–17.3.5, and 17.4–17.4.2, enabling deploy keys to push to archived repositories. The connected documents confirm the affected ranges and the action (deploy keys abuse), but no explicit root-cause details beyond the described behavior ar...

MAL-2024-9244 Malicious code in prismjs-editor-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 040f9d206fa46c86f67191c2a1777918670867a6e0888635b2f08567360ba10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9239 Malicious code in jacoco-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b69d2d6c05db4695b8af9c114b5851c1c95e7e59f07fa671941231429709fb2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9248 Malicious code in redux-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f0972d9d0c165383cf5d724889a9c0b58cd2ffa5ff2ec57df1d3f56a33b5609 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9220 Malicious code in com.sendbird.calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 673f118ef1bd121c69542e3a9d813f6e42601d38118849a030f91f89ecacd45b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9256 Malicious code in typescript-error-reporter-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94ae0fc6c94bf4a0b84cd232b32cd4e5e36d035e62b1dea57e7c41d39d2c2406 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...