Default configuration

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to...

Malicious Package

Overview repository-audit is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

CVE-2021-32690

Helm before version 3.6.1 has an information-disclosure flaw where credentials tied to a Helm repository could be passed to other domains listed in the repository’s index.yaml. The issue is fixed in 3.6.1; a workaround involves auditing index.yaml for other domains in the urls list to see if cred...