CVE-2022-34177

Jenkins Pipeline: Input Step Plugin 448.v37cea9a10a70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers...

Malicious code in pipelines-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8899971ffea385fe69c7db3bf9b9aa93bd739ba707bd4641667df007940cf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5343 Malicious code in pipelines-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8899971ffea385fe69c7db3bf9b9aa93bd739ba707bd4641667df007940cf6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in snyk-azure-pipelines-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1415763e729b09889f3cb0714d88b936b6c14f499ccbdd82f5697fe861fcc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6194 Malicious code in snyk-azure-pipelines-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1415763e729b09889f3cb0714d88b936b6c14f499ccbdd82f5697fe861fcc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-Q874-G24W-4Q9G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

GHSA-Q874-G24W-4Q9G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

Update now!  Microsoft patches Follina, and many other security updates

The June 2022 Patch Tuesday may go down in history as the day that Follina got patched, but there was a host of other important updates. And not just from Microsoft. Many other software vendors follow the pattern of monthly updates set by the people in Redmond. Microsoft Microsoft released update...

CVE-2022-29241 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2022-29241 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1362 Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Uncover Rust Supply Chain Attack Targeting Cloud CI Pipelines

A case of software supply chain attack has been observed in the Rust programming language's crate registry that leveraged typosquatting techniques to publish a rogue library containing malware. Cybersecurity firm SentinelOne dubbed the attack "CrateDepression." Typosquatting attacks take place wh...

GitLab 9.2 < 14.8.6 / 14.9 < 14.9.4 / 14.10 < 14.10.1 (CVE-2022-1460)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab wa...

CVE-2022-30949

Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents...

CVE-2022-30945

Jenkins Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines...

CVE-2022-30945

Jenkins Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines...

PT-2022-20399 · Jenkins · Jenkins Pipeline: Groovy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier Description: The issue allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. This could potentially be used to...

Malicious code in com.unity.render-pipelines.high-definition-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67f837ca8ea83c83003168af81c90f02e07a73994e832484930baf383acb5b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2101 Malicious code in com.unity.render-pipelines.high-definition-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67f837ca8ea83c83003168af81c90f02e07a73994e832484930baf383acb5b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...