CVE-2023-51664: Improper Neutralization of Special Elements used in a Command

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrar...

Rhadamanthys Malware: Swiss Army Knife of Information Stealers Emerges

The developers of the information stealer malware known as Rhadamanthys are actively iterating on its features, broadening its information-gathering capabilities and also incorporating a plugin system to make it more customizable. This approach not only transforms it into a threat capable of...

MAL-2023-8637 Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

Malicious code in @terraform-aws-github-runner/aws-ssm-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923d8c9265a141fb0384c59b41ad9dea10d1d2ee7a4d30165537b10a69d82e40 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-util' @ 1.0.0 npm as malicious. It is considered malicious...

Malicious code in @terraform-aws-github-runner/aws-ssm-uti (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9e8dee05678c6b03df102e495749bdc9db8ae73a32752a0f85345cc637577012 The OpenSSF Package Analysis project identified '@terraform-aws-github-runner/aws-ssm-uti' @ 1.999.0 npm as malicious. It is considered maliciou...

Malware in test262-runner

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in test262-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cee87d436e3a799f9c25994010662db61c2e7c3cdcefc4eab8e8d437f38e1755 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, yq, dex-k8s-authenticator, vertical-pod-autoscaler, prometheus-blackbox-exporter, metrics-server-fips, kubeflow-katib, falcoctl, kaf, secrets-store-csi-driver, atlantis-fips, flux, pulumi-kubernetes-operator,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: nats, kubescape, prometheus-operator, nodetaint, pulumi-language-java, cue, metrics-server, tkn, go, crossplane-provider-azure, dgraph, flux-kustomize-controller, kubernetes-ingress-defaultbackend, pulumi-language-yaml, zot, aws-load-balancer-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nats, kubescape, grype, cortex, nodetaint, pulumi-language-java, cue, metrics-server, dgraph, flux-kustomize-controller, pulumi-language-yaml, aactl, aws-efs-csi-driver, rqlite, bom, frp, terraform-provider-azurerm, helm, nri-prometheus, k3d, weaviate, nghttp2,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: nats, kubescape, grype, cortex, nodetaint, pulumi-language-java, cue, metrics-server, dgraph, flux-kustomize-controller, pulumi-language-yaml, aactl, aws-efs-csi-driver, rqlite, bom, frp, terraform-provider-azurerm, helm, nri-prometheus, k3d, weaviate, nghttp2,...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Improper Authorization

gitlab is vulnerable to Improper Authorization. This vulnerability allows a malicious unauthorized GitLab user to attach a malicious runner to any project through GraphQL endpoints...

Server-Side Request Forgery (SSRF)

gitlab is vulnerable to Server-Side Request Forgery SSRF. The vulnerability exists in web terminal advertiseaddress which allows an attacker to connect to local addresses when configuring a malicious GitLab Runner...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to a flaw in the way that GitLab handles the GitLab Runner API. An attacker can exploit this vulnerability to inject arbitrary code into the GitLab Runner process...

CVE-2023-34236

Weave GitOps Terraform Controller aka Weave TF-controller is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This...

GHSA-6HVV-J432-23CV Weave GitOps Terraform Controller Information Disclosure Vulnerability

Impact A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners tf-runner, where sensitive data is inadvertently printed - potentially...

CVE-2023-34236

Weave GitOps Terraform Controller aka Weave TF-controller is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This...

CVE-2023-34236: Exposure of Sensitive Information to an Unauthorized Actor

Weave GitOps Terraform Controller aka Weave TF-controller is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This...

PT-2023-24760 · Weave · Weave Gitops Terraform Controller

Name of the Vulnerable Software and Affected Versions: Weave GitOps Terraform Controller versions prior to v0.14.4 Weave GitOps Terraform Controller versions prior to v0.15.0-rc.5 Description: A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an...