CVE-2023-34111 Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin

The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of $ github.event.pullrequest.title in a bash command within the GitHub...

MAL-2023-365 Malicious code in fc-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7f4167da0bf5409b53f5b683dcdb962d93b6d03e2d9e3916c5859f78f8f9f1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-567 Malicious code in libponenunber-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a89a63696ce9e53ae77cca0d28b82c9f35f8641a17d0e39f74636ab6fb4fbe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Severe Flaw in Google Cloud's Cloud SQL Service Exposed Confidential Data

A new security flaw has been disclosed in the Google Cloud Platform's GCP Cloud SQL service that could be potentially exploited to obtain access to confidential data. "The vulnerability could have enabled a malicious actor to escalate from a basic Cloud SQL user to a full-fledged sysadmin on a...

CVE-2023-33264

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets...

GHSA-H3QR-39J9-4R5V Data written to GitHub Actions Cache may expose secrets

Impact This vulnerability impacts GitHub workflows using the Gradle Build Action that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configured for the repository. Secrets configured for GitHub Actions are normally passed to the Gradle Build...

CVE-2023-30853

CVE-2023-30853 describes an information disclosure in the Gradle Build Action for GitHub Actions when the configuration cache is enabled in versions prior to 2.4.2. Environment variables passed to Gradle can be persisted into GitHub Actions cache entries, which may be read by untrusted workflows ...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

PT-2023-22078 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.11.16 Cilium versions prior to 1.12.9 Cilium versions prior to 1.13.2 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log t...

CVE-2023-26493 Command Injection in Cocos Engine workflow

Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the web-interface-check.yml was subject to command injection. The web-interface-check.yml was triggered when a pull request was opened or updated and...

MAL-2023-189 Malicious code in cms-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e7660bdda7ac53c4bd35a3b5698ca80b7d2f5bf8bd47a5e7e6163aead683350 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2020-8566

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

SUSE CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

SUSE CVE-2021-3681

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explicitly excluded via the buildignore list in "galaxy.yml" include files in the .tar.gz file. This contains sensitive info, such as the user's Ansible Galaxy A...

MAL-2023-231 Malicious code in delta-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccf1578d031db527a894c33da7eafd61638d10822d39d19172cb3572d18b72ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-163 Malicious code in cathode-versions-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0e16e7e4327697f795d989d71781e02f4036cfffca1d0dce1e5b9a6f0a54f7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Plugin OSF Builder Suite :: XML Linter 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A code issu...

GHSA-MF4P-WJRM-CMJP AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

S3 Explorer Plugin stores AWSSECRETACCESSKEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the...

MAL-2022-2366 Malicious code in dc-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2dceb4a54732ea88a32914ede9a5ffd5c61c8593fa9ac72465d3f691b8e8f96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2653 Malicious code in ebayui-ads (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ab074972f923b11e148393b0e2759e65eb3b531563049d5b7304d6098384376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...