| Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code |
|
|
|
| Command Injection in the GitHub Pages Build Pipeline |
|
|
|
| [UNPATCHED] Cli: gh run download implementation allows overwriting git repository configuration upon artifacts downloading |
|
|
|
| ATO without any interaction [aws cognito misconfiguration] |
|
|
|
| Package Planting: Are You [Unknowingly] Maintaining Poisoned Packages? |
|
|
|
| NotGitBleed |
|
|
|
| New npm Flaws Let Attackers Better Target Packages for Account Takeover |
|
|
|
| Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline |
|
|
|
| GitHub Cache Poisoning |
|
|
|
| Git honours embedded bare repos, and exploitation via core.fsmonitor in a directory's .git/config affects IDEs, shell prompts and Git pillagers |
|
|
|
| Securing Developer Tools: Git Integrations |
|
|
|
| Stealing a few more GitHub Actions secrets |
|
|
|
| RCE in GitHub Desktop < 2.9.4 |
|
|
|
| My first report on HackerOne: A logic flaw in npm |
|
|
|
| "Zero-Days" Without Incident - Compromising Angular via Expired npm Publisher Email Domains |
|
|
|
| NPM might be executing malicious code in your CI without your knowledge |
|
|
|
| Bounty Evaluation GitHub = $15,000 US Dollars | Rate Limit |
|
|
|
| Cache Poisoning at Scale |
|
|
|
| Insufficient Redirect URI validation: The risk of allowing to dynamically add arbitrary query parameters and fragments to the redirect_uri |
|
|
|
| Bypassing required reviews using GitHub Actions |
|
|
|
| GitHub Actions check-spelling community workflow - GITHUB_TOKEN leakage via advice.txt symlink |
|
|
|
| Detecting Jackson deserialization vulnerabilities with CodeQL |
|
|
|
| Diving into Dependabot along with a bug in npm |
|
|
|
| Supply Chain Attacks via GitHub.com Releases |
|
|
|
| Breaking GitHub Private Pages for $35k |
|
|
|
writeups.xyz
/
GitHub