CVE-2021-41077

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior (if .travis.yml has been created locally by a customer, and added to git) is for a Travis service to perform builds in a way that prevents public access to customer-specific secret environment data such as signing keys, access credentials, and API tokens. However, during the stated 8-day interval, secret data could be revealed to an unauthorized actor who forked a public repository and printed files during a build process.

• CWE-862

• https://blog.travis-ci.com/2021-09-13-bulletinVendor Advisory
• https://news.ycombinator.com/item?id=28523350Third Party Advisory
• https://news.ycombinator.com/item?id=28524727Third Party Advisory
• https://travis-ci.community/t/security-bulletin/12081Vendor Advisory
• https://twitter.com/peter_szilagyi/status/1437646118700175360Third Party Advisory
• https://twitter.com/peter_szilagyi/status/1437649838477283330Third Party Advisory
• https://blog.travis-ci.com/2021-09-13-bulletinVendor Advisory
• https://news.ycombinator.com/item?id=28523350Third Party Advisory
• https://news.ycombinator.com/item?id=28524727Third Party Advisory
• https://travis-ci.community/t/security-bulletin/12081Vendor Advisory
• https://twitter.com/peter_szilagyi/status/1437646118700175360Third Party Advisory
• https://twitter.com/peter_szilagyi/status/1437649838477283330Third Party Advisory

Published

Sep 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41071Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41072squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allow…8.1
• CVE-2021-41073loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 throu…7.8
• CVE-2021-41074A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 a…5.4
• CVE-2021-41075The NetFlow Analyzer in Zoho ManageEngine OpManger before 12…9.8
• CVE-2021-41076Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41078Nameko through 2.13.0 can be tricked into performing arbitra…7.8
• CVE-2021-41079Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0…7.5
• CVE-2021-4108snipe-it is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125…9.8
• CVE-2021-41082Discourse is a platform for community discussion. In affecte…7.5