Advisories · Weakness
CWE-1357.
Every Advisory and CVE whose sources give the weakness CWE-1357, newest first.
- CVSS 10.0 CriticalCritical · CVSS 9+
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
- saltyorg docs
- Code injection
- CWE-829
- CVSS 8.0 High
Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope
- Red Hat Quay 3
- CWE-1357
- CVSS 5.3 Medium
Dell PowerProtect One: Dell PowerProtect One, versions 20.1.0.0 and below…
- Dell PowerProtect One
- CWE-1357
- CVSS 7.7 High
Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-1357
- CVSS 4.4 Medium
Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- CWE-1357
- CVSS 6.6 Medium
NVIDIA Dynamo: NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker…
- NVIDIA Dynamo
- CWE-1357
- CVSS 7.2 High
Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI
- conda-build
- CWE-1357
- CVSS 8.6 High
SUBNET Substation Server Reliance on Insufficiently Trustworthy Component
- SUBNET Substation Server
- CWE-1357
- CVSS 8.6 High
SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component
- SUBNET PowerSYSTEM Center
- CWE-1357
- CVSS 8.6 High
SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component
- SUBNET Solutions PowerSYSTEM Server
- SUBNET Solutions Substation Server 2021
- CWE-1357