GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.
- Tweets 1,449
- Following 15
- Followers 26,558
- Likes 189
GHSL-2024-323: Denial of Service (DoS) in snapcraft securitylab.github.com/advis…
5
5
4
3,333
GHSL-2024-296: Deserialization of untrusted data in Kykms securitylab.github.com/advis…
2
7
2,136
GHSL-2024-273: ReDoS in remove_html_tags of Gradio securitylab.github.com/advis…
1
8
1,609
GHSL-2024-327: Poisoned Pipeline Execution (PPE) in Microsoft FluentUI securitylab.github.com/advis…
1
1
6
1,600
GHSL-2024-254: Poisoned Pipeline Execution (PPE) in Amplification leading to potential acccount takeover securitylab.github.com/advis…
2
8
1,353
How to secure your GitHub Actions workflows with CodeQL. Dive into this actionable supply chain security research from @pwntester . This work resulted in dozens of high impact supply chain findings and, most importantly, added CodeQL support for your GitHub workflows! github.blog/security/applica…
6
15
53
5,773
GHSL-2024-303: Code execution in trusted context via a GitHub Action of Tribler securitylab.github.com/advis…
1
7
1,030
GHSL-2024-173: Environment Variable injection in a Feign GitHub Actions workflow securitylab.github.com/advis…
1
5
1,299
🎉 Excited to announce the launch of CodeQL Community Packs for Security teams and researchers!
🚀 Supercharge your code analysis with new Query, Model, and Library packs, to find more vulnerabilities, accelerate codebases audit, and secure code effortlessly.
github.blog/security/vulnera…
1
12
38
5,025
GHSL-2024-091_GHSL-2024-092: DNS rebinding attacks against Home-gallery - CVE-2024-53275, CVE-2024-53276
securitylab.github.com/advis…
1
2
8
1,332
GHSL-2024-075_GHSL-2024-076: Stored Cross-Site Scripting (XSS) and Remote Code Execution (RCE) via Velocity Template Evaluation in Sonatype Nexus 2
securitylab.github.com/advis…
1
10
1,151
GHSL-2024-072_GHSL-2024-074: Stored Cross-Site Scripting (XSS), Arbitrary File Upload, and Arbitrary File Read/Write via Path Traversal in Reposilite - CVE-2024-36115, CVE-2024-36116, CVE-2024-36117
securitylab.github.com/advis…
1
5
893
🎉 You can now enable code scanning in your GitHub Actions workflow files!
✅ By opting-in to this feature, you can enhance the security of repositories using GitHub Actions.
github.blog/changelog/2024-1…
7
18
5,689
29 new vulnerabilities found in GStreamer by @nosoynadiemas! Click to learn how to improve fuzzing results with custom generators. github.blog/security/vulnera…
16
43
4,576
🚨 Over 20 new GStreamer security advisories are live! Huge thanks to the @gstreamer team for fixing these vulnerabilities and to @Nosoynadiemas for his valuable contributions. Learn more: securitylab.github.com/advis…
5
9
1,422
GHSL-2024-294: Environment variable injection leading to potential secret exfiltration and privilege escalation in Azure/cli
securitylab.github.com/advis…
1
1
6
1,124
GHSL-2024-312: Arbitrary code execution and secret exfiltration in Azure API Management Developer Portal
securitylab.github.com/advis…
4
844
🚀 Level up your CodeQL skills! In Part 4 of @BlazingWindSec's "Zero to Hero" series, we dive into @HuggingFace’s Gradio framework—showing how to uncover vulnerabilities with real-world insights. Ready to explore? 🛠️🔍
👉 github.blog/security/vulnera…
#CodeQL #BugBounty #OpenSourceSecurity
11
52
25,180
Excited to see @blazingwindsec recognized in @freeCodeCamp's Security Hall of Fame for uncovering and reporting a security vulnerability in their demo projects. 🎉 Her work helps keep open source safer for everyone! Check it out: contribute.freecodecamp.org/…
1
8
1,195