CVE-2020-26226

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a U...

CVE-2020-26226 Secret disclosure in semantic-release

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a U...

CVE-2020-26226

CVE-2020-26226 affects the npm package semantic-release (pre-17.2.3). The vulnerability causes secrets that should be masked to be disclosed when they contain characters that become URI-encoded in a URL. The issue is resolved in version 17.2.3; upgrade to 17.2.3 or newer to mitigate. The CVSS met...

GHSA-R2J6-P67H-Q639 Secret disclosure when containing characters that become URI encoded

Impact Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Patches Fixed in v17.2.3 Workarounds Secrets that do not contain characters that become encoded when included in a URL are already...

@arbetsmyra/semantic-release-config (>=1.0.2, <=1.1.4), @crystal-ball/semantic-release-base (>=2.13.0, <=2.22.0) +17 more potentially affected by CVE-2020-26226 via semantic-release (>=17.0.1, <=17.2.2)

semantic-release NPM version =17.0.1, =1.0.2, =2.13.0, =1.63.0, =2.0.0, =10.1.2, =1.2.0, =1.0.0, =1.4.0, =4.0.19, =8.0.0, =2.4.9, =10.0.0, =11.0.0 and more Source cves: CVE-2020-26226 Source advisory: OSV:GHSA-R2J6-P67H-Q639...

Semantic release security vulnerability

Semantic release is a Js-based versioning and package distribution tool from the Semantic release team. A security vulnerability exists in versions prior to npm semantic-release 17.2.3, which stems from the possibility of accidental disclosure if a character encoded in a URL is included...

Hacking AI-Graded Tests

The company Edgenuity sells AI systems for grading tests. Turns out that they just search for keywords without doing any actual semantic analysis...

Hacking AI-Graded Tests

The company Edgenuity sells AI systems for grading tests. Turns out that they just search for keywords without doing any actual semantic analysis...

GHSA-P9VV-3945-X93H Cross-Site Scripting in semantic-ui-search

All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. Recommendation No fix is currently available. Consider using an alternative module until a fix is made...

Cross-Site Scripting in semantic-ui-search

All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. Recommendation No fix is currently available. Consider using an alternative module until a fix is made...

LNAV - Log File Navigator

The log file navigator, lnav, is an enhanced log file viewer that takes advantage of any semantic information that can be gleaned from the files being viewed, such as timestamps and log levels. Using this extra semantic information, lnav can do things like interleaving messages from different...

Information Disclosure

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.51. See the following advisory for the container...

Cross-Site Scripting

Overview All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. Recommendation No fix is currently available. Consider using an alternative module until a fix i...

Read: How To Build Resilient Cloud Configuration Shields

Configurable systems have a high level of flexibility and are better adapted to most customer needs, but their management isn’t a trivial task in complex cloud deployments. The configuration management concept isn't new and originated in the United States Department of Defense in the 1950s as a...

GHSA-6528-WVF6-F6QG Pycrypto generates weak key parameters

lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional Diffie-Hellman DDH...

CVE-2018-6829

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...

Information disclosure

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...

CVE-2018-6829

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...

CVE-2018-6829

CVE-2018-6829 affects Libgcrypt’s ElGamal (cipher/elgamal.c) up to version 1.8.2. When used to encrypt messages directly, it can improperly encode plaintexts, allowing a ciphertext-only attacker to recover sensitive information. The issue is tied to Libgcrypt’s DDH assumption not holding for its ...

CVE-2018-6829

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data i.e., it does not have semantic security in face of a ciphertext-only attack. The Decisional...