1647 matches found
CVE-2024-27920
The CVE covers projectdiscovery/nuclei where unsigned code templates could be executed via workflows in Nuclei v3. root cause: oversight in workflow execution that allows executing unsigned templates. Impact: local execution with high severity per listed metrics; effects are mitigation-dependent ...
CVE-2024-27920 Unsigned code template execution through workflows in projectdiscovery/nuclei
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...
GHSA-W5WX-6G2R-R78Q Nuclei allows unsigned code template execution through workflows
Overview A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This...
Nuclei allows unsigned code template execution through workflows
Overview A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This...
CVE-2024-27920: Improper Neutralization of Special Elements used in an OS Command
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: dgraph, cloudflared, wolfictl, ko, skaffold, vexctl, sigstore-scaffolding, slsa-verifier, step, kots, sops, fulcio, gitsign, minio, tkn, zot, spire-server, nerdctl, aactl, dex, weaviate, caddy, k3s, frp, kargo, goreleaser, kube-rbac-proxy, melange, guac, skopeo,...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: kine, wavefront-collector-for-kubernetes, ferretdb, amass, caddy-fips, falcosidekick-fips, k3s, src, argo-workflows, trillian, step-ca, caddy, step, trillian-fips, spicedb, argo-workflows-fips, kube-bench-fips, kots, kube-bench, temporal-server-fips, temporal-server...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: temporal-server, trillian, spicedb, kube-bench, kine, argo-workflows, src, caddy, amass, k3s, step-ca, step, ferretdb, kots...
CVE-2024-27289 vulnerabilities
Vulnerabilities for packages: trillian, argo-workflows, caddy, step, step-ca, kots...
BIT-ARGO-WORKFLOWS-2021-37914
In Argo Workflows through 3.1.3, if EXPRESSIONTEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated...
BIT-ARGO-WORKFLOWS-2022-29164 Privilege Escalation in argo-workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...
GHSA-8R3F-844C-MC37 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws, metacontroller, configmap-reload, osv-scanner, pulumi-language-java, actions-runner-controller, crossplane-provider-aws-sns, crossplane-provider-aws-cloudfront, nri-kubernetes, stakater-reloader, cri-tools, hugo-extended,...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: nri-discovery-kubernetes, crossplane-provider-aws-rds, conftest-fips, metrics-server-fips, pulumi-language-dotnet, node-problem-detector, gitsign, k8sgpt, crossplane-provider-azure, metrics-server, step-ca, nats, nri-kubernetes, terraform-provider-google, tflint,...
Lessons from video game companies: automation unleashes robust monitoring & observability
Video game organizations need robust monitoring and observability solutions to stay one step ahead of cyber adversaries. Chances are, so do we all. In this blog post, we’ll delve into how monitoring and observability capabilities enable video game organizations to bolster their cybersecurity...
GHSA-7JWH-3VRQ-Q3M8 vulnerabilities
Vulnerabilities for packages: temporal-server, trillian, spicedb, kube-bench, kine, argo-workflows, src, caddy, amass, k3s, step-ca, step, ferretdb, kots...
GHSA-7JWH-3VRQ-Q3M8 vulnerabilities
Vulnerabilities for packages: kine, wavefront-collector-for-kubernetes, ferretdb, amass, caddy-fips, falcosidekick-fips, k3s, src, argo-workflows, trillian, step-ca, caddy, step, trillian-fips, spicedb, argo-workflows-fips, kube-bench-fips, kots, kube-bench, temporal-server-fips, temporal-server...
GHSA-MRWW-27VC-GGHV vulnerabilities
Vulnerabilities for packages: kine, wavefront-collector-for-kubernetes, ferretdb, amass, caddy-fips, falcosidekick-fips, k3s, src, argo-workflows, trillian, step-ca, caddy, step, trillian-fips, spicedb, argo-workflows-fips, kube-bench-fips, kots, kube-bench, temporal-server-fips, temporal-server...
GHSA-M7WR-2XF7-CM9P vulnerabilities
Vulnerabilities for packages: caddy-fips, step-ca, caddy, argo-workflows-fips, wavefront-collector-for-kubernetes, step, trillian-fips, kots, argo-workflows, trillian...
6 Ways to Simplify SaaS Identity Governance
With SaaS applications now making up the vast majority of technology used by employees in most organizations, tasks related to identity governance need to happen across a myriad of individual SaaS apps. This presents a huge challenge for centralized IT teams who are ultimately held responsible fo...
CVE-2024-1482 Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUBTOKEN. To exploit this vulnerability, an attacker would need access...