1017 matches found
Insecure Variable Substitution
github.com/go-vela/server is vulnerable to Insecure Variable Substitution. This vulnerability is due to the use of variable substitution combined with insensitive fields such as parameters, image, and entrypoint in Vela pipelines. The vulnerability allows an attacker to bypass log masking and...
GHSA-CXJH-PQWP-8MFP vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, kubeflow-pipelines, kubeflow-centraldashboard, configurable-http-proxy, lerna, opensearch-dashboards, kibana...
CVE-2024-28849 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, kubeflow-pipelines, kubeflow-centraldashboard, configurable-http-proxy, lerna, opensearch-dashboards, kibana...
CVE-2024-28849 vulnerabilities
Vulnerabilities for packages: configurable-http-proxy, kubeflow-pipelines, kubeflow-centraldashboard, lerna...
PT-2024-22351 · Vela · Vela
Name of the Vulnerable Software and Affected Versions: Vela versions prior to 0.23.2 Description: Vela pipelines can use variable substitution combined with insensitive fields like parameters, image, and entrypoint to inject secrets into a plugin/image and bypass log masking, exposing secrets...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard, dex, dgraph, minio, sops, vexctl, wolfictl, flux-source-controller, goreleaser, aactl, terragrunt, guac, melange, kots, spire-server, kargo, rabbitmq-messaging-topology-operator, skopeo, weaviate, fulcio, gitsign, sigstore-scaffolding, tkn, cadd...
CVE-2024-28110 vulnerabilities
Vulnerabilities for packages: falcosidekick-fips, falcosidekick, guac...
GHSA-5PF6-2QWX-PXM2 vulnerabilities
Vulnerabilities for packages: guac, falcosidekick...
GHSA-5PF6-2QWX-PXM2 vulnerabilities
Vulnerabilities for packages: falcosidekick-fips, falcosidekick, guac...
CVE-2024-28152
A flaw was found in jenkins-2-plugins. Multibranch Pipelines with a Bitbucket branch source can be configured to discover pull requests from forks. The trust policy is set to "Forks in the same account" by default. In Bitbucket Branch Source Plugin 866.vdea7dcd3008e and earlier, except...
BIT-GITLAB-2020-10979
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...
BIT-GITLAB-2020-13351
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are =13.0, =13.4.0, =13.5.0, 13.5.2...
BIT-GITLAB-2021-22248
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only...
BIT-GITLAB-2022-1460
An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a...
BIT-GITLAB-2022-3759
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child...
BIT-GITLAB-2023-5106 Incorrect Authorization in GitLab
An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...
Important: composer
Issue Overview: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead...
GHSA-6VQW-3V5J-54X4 vulnerabilities
Vulnerabilities for packages: mitmproxy, py3-cassandra-medusa, kubeflow-pipelines, ggshield, az, py3-cryptography, request-1276...