clusterfuzzlite

ClusterFuzzLite ClusterFuzzLite는 지속적인 퍼징 솔루션으로, 지속적 통합CI 워크플로의 일부로 실행되어 그 어느 때보다 빠르게 취약점을 찾아냅니다. 몇 줄의 코드만으로 GitHub 사용자는 ClusterFuzzLite를 워크플로에 통합하고 풀 리퀘스트를 퍼징하여 커밋되기 전에 버그를 잡을 수 있습니다. ClusterFuzzLite는 ClusterFuzz를 기반으로 합니다. 기능 코드 변경풀 리퀘스트 퍼징으로 버그가 배포되기 전에 신속하게 발견 크래시를 유발하는 테스트 케이스 다운로드 더 오래 실행되는...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

CVE-2024-37051

CVE-2024-37051 分析 概要 CVE-2024-37051 は、JetBrains の IntelliJ ベースの IDE に見つかった脆弱性で、GitHub プラグインに影響を与えます。悪意のあるプルリクエスト PR が読み込まれると、GitHub アクセストークンが不正に露出される可能性があります。 技術詳細 この脆弱性は、IDE 内で PR をレンダリングする際に発生します。悪意のある PR により、IDE が攻撃者の指定した URL に GitHub トークンを送信する可能性があります。パッチにはホスト検証が含まれており、トークンが認可された GitHub...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

layne

Layne Layneは、リポジトリ全体のセキュリティスキャンを一元化するセルフホスト型GitHub Appです。市販のSAST・シークレットスキャンツールを使用しておらず、GitHub Enterpriseにもアクセスできないため、特にリポジトリの数が増えるにつれて、異なるリポジトリ間で複数のGitHub Actionsワークフローファイルを維持管理することが難しくなります。そこで、Layneを一度インストールすれば、プルリクエストイベントをリッスンし、セキュリティツールをサーバー側で実行し、結果をネイティブなGitHub Check...

CVE-2026-75101

An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...

wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-52806

Gogs RCE — git rebase における引数インジェクション CWE-88 プルリクエストのマージフローにおける引数インジェクションを介した、Gogs という名前のブランチは、位置引数ではなく Git によって --exec フラグとして解析され、リベース中に再生された各コミットの後に sh -c が実行されます。 エクスプロイトの仕組み 1. 事前確認 Pre-flight — ターゲットが Gogs を実行しているか判定し、静的アセットの ?v= パラメータでバージョンを特定し、ユーザー登録がオープンか、CAPTCHA 保護付きか、無効かを確認します。 2. 認証 —...

CVE-2026-54918: External Control of System or Configuration Setting

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

EUVD-2026-80763

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139: Server-Side Request Forgery (SSRF)

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

SSRF vulnerability in bitbucket-push-and-pull-request allows capturing credentials

bitbucket-push-and-pull-request provides a webhook endpoint at /bitbucket-hook/ to receive webhook notifications. When acting on these notifications, bitbucket-push-and-pull-request 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...