OPENSUSE-SU-2024:14287-1 forgejo-runner-3.5.1-1.1 on GA media

These are all security issues fixed in the forgejo-runner-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

CVE-2024-42482: Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

Malicious code in stackstorm-runner-action-chain (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0cc9e6be890f15ba83b67af002dc0fdec59a68ebdd2696ab5168df443ed2dabf Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11714 Malicious code in stackstorm-runner-action-chain (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0cc9e6be890f15ba83b67af002dc0fdec59a68ebdd2696ab5168df443ed2dabf Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

SUSE-SU-2024:2574-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: Update to 20.15.1: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import restriction via data URL bsc1227554 - CVE-2024-22018: Fixed fs.lstat bypasses permission model bsc1227562 -...

Malicious code in cucumber-rake_runner (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4055 Malicious code in Be.Vlaanderen.Basisregisters.PrоjеctionHandling.Runner.Microsoft (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderen.Bаsisregisters.PrоjеctionHandling.Runner.Miсrosoft (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4109 Malicious code in Be.Vlaanderen.Bаsisregisters.PrоjеctionHandling.Runner.Miсrosoft (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Bе.Vlaanderen.Basisregisters.ProjectionHandling.Runnеr (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Bе.Vlaanderen.Bаsisregisters.ProjectioոHandling.Runnеr (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in github-runner-lambda-syncer (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2422 Malicious code in github-runner-lambda-syncer (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: fulcio, policy-controller, rook, timestamp-authority, zarf, k8sgpt, boring-registry, velero, terragrunt, ksops, opentelemetry-collector, flux-image-reflector-controller, sqlpad, trino, restic, opentelemetry-collector-contrib, sigstore-scaffolding, spire-server,...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

BIT-GITLAB-2024-2874 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources...

UBUNTU-CVE-2024-2874

An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources...