MAL-2024-1426 Malicious code in @juiggitea/dolorum-temporibus-ipsam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79ac2488be1040c18e2f07a682c17be3f26d6ce4b26b9908ae78e6055878eef1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1346 Malicious code in jhsdfgghsdfjhds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15cdbadc3c6de57d6cd2d2cb0a8aa99320ed82d13978c3a2667183e8c04f416a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-25948 · Unknown · Filecodebox

Name of the Vulnerable Software and Affected Versions: FileCodeBox version 2.0 Description: The issue concerns the storage of sensitive information in cleartext. Specifically, FileCodeBox stores a OneDrive password and an AWS key in a cleartext env file. This poses a significant risk as it could...

MAL-2024-1121 Malicious code in packagerandomattackertest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf42b61bc6d1d4768731c33802583275971ebe6621404ad29aee53fb653a666a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-V8MX-HP2Q-GW85 Golang SDK for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-69P4-J5V5-X234 Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-7V38-W32M-WX4M Types for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-PWX5-6WXG-PX5H Insecure Variable Substitution in Vela

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

CVE-2024-28236

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

Input validation

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

CVE-2024-28236 Insecure Variable Substitution in Vela

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

CVE-2024-28236 Insecure Variable Substitution in Vela

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

PT-2024-21800

Name of the Vulnerable Software and Affected Versions Docassemble versions 1.4.53 through 1.4.96 Description The issue allows attackers to gain unauthorized access to information on the system through URL manipulation. It is an unauthenticated path traversal flaw that exposes sensitive files and...

MAL-2024-928 Malicious code in discord.js-dmall-v11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd9c3a4166db72fb9307f7a0e8727926cdbf66166bab94d2031d450120a8f036 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-935 Malicious code in iifl_serialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fee2df05c15b754e46f9e40e85e67b0499b639943c4674ff0ac4cce7a91aea2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-873 Malicious code in wlwz-2312-7801 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aaf66057ed5652a0d2838dfdee19edebb9c1011169b2fb7cce34c906f919cc25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-289 Malicious code in wlwz-2312-1302 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 570aad10d0978c1e540b674905c55d67e5d17e139a4f032ace5630e5a963f4bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-781 Malicious code in wlwz-2312-6708 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48c095942c1a21b64d1c52edb7b4b7e7bc1e7f95ee7f2bb6fc30a34d38c93fd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-677 Malicious code in wlwz-2312-5603 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d3af2495fdeab060f4b09806273c71748ca627a7122a3d582005678e7a9ea14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...