Malicious Package

Overview openwhisk-probot-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

EUVD-2018-3776

Malware in sbrugna...

EUVD-2018-3775

Malware in sbrugna...

MAL-2025-47855 Malicious code in openwhisk-probot-builder (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df529e6edfae25a9476f48b45ecffb81a502aff2baa1f23ffe224a99c88a0fa5 Any computer that has this package installed or running should be considered...

Malicious code in openwhisk-probot-builder (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df529e6edfae25a9476f48b45ecffb81a502aff2baa1f23ffe224a99c88a0fa5 Any computer that has this package installed or running should be considered...

GHSA-53MJ-MC38-Q894 Remote Memory Exposure in openwhisk

Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to apikey, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header base64-encoded. Proof of concept: js var openwhisk = require'openwhisk...

Remote Memory Exposure in openwhisk

Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to apikey, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header base64-encoded. Proof of concept: js var openwhisk = require'openwhisk...

Apache OpenWhisk Remote Code Execution Vulnerability

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. PHP Runtime for Apache OpenWhisk is its PHP-based version. A security vulnerability exists in PHP Runtime for Apache OpenWhisk. The vulnerability can be exploited to replace the source code of a...

Apache OpenWhisk Remote Code Execution Vulnerability (CNVD-2018-14727)

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. Docker Skeleton Runtime for Apache OpenWhisk is its Docker-based version. A security vulnerability exists in Docker Skeleton Runtime for Apache OpenWhisk. The vulnerability can be exploited to...

Security Bulletin: IBM Cloud Functions is affected by two function runtimevulnerabilities

Summary IBM Cloud Functions has addressed the following vulnerabilities. Users of the IBM Cloud Functions service that are using docker actions https://console.bluemix.net/docs/openwhisk/openwhiskactions.htmlcreating-docker-actions are affected but only if the user's function has a general securi...

Apache, IBM Patch Critical Cloud Vulnerability

Apache and IBM have patched a critical vulnerability that allows attackers to replace a company’s serverless code with their own malicious script. Once running, the bad code could then be used for a range of nefarious tasks, including extracting confidential customer data such as passwords or...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11757

In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

Code injection

In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

Code injection

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11757

In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11757

CVE-2018-11757 affects Docker Skeleton Runtime for Apache OpenWhisk. A Docker action using openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. The issue is described in multiple so...

CVE-2018-11756

CVE-2018-11756 affects the PHP Runtime for Apache OpenWhisk when used as a Docker action based on tags such as openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (and older). The vulnerability allows a remote attacker to overwrite the source code of a function executing inside the...