Harness (Vendor): news timeline & CVEs

harness Gitspace hardcoded password for every user account

Researcher discloses a hardcoded password shared by every Harness Gitspace user account.

Khashayar Fereidani reported to Full Disclosure that Harness Gitspaces use a hardcoded password for every user account. Gitspaces are Harness hosted development environments: a container with the user's source tree, an SSH server, and an IDE, with ports published externally. The posting does not cite a CVE or state that exploitation has been observed.

Full Disclosure04:14 UTC · 5h agoVulnerability

harness(gitness) registry webhook sort_order blind SQL injection

Harness open-source Gitness has a blind SQL injection in the registry webhook sort_order parameter.

Khashayar Fereidani disclosed a blind SQL injection in the sort_order parameter used when listing registry webhooks in Harness open source (Gitness). Gitness is a self-hosted platform for source control, pipelines, and artifact registries. The affected call is the registry API endpoint that lists a registry's webhooks. No CVE or in-the-wild exploitation is stated.

Full Disclosure04:14 UTC · 5h agoVulnerability

Harness

Timeline2 articles

Appears with

harness Gitspace hardcoded password for every user account

harness(gitness) registry webhook sort_order blind SQL injection