com.blazemeter.plugins:blazemeterjenkinsplugin (>=2.0, <=2.6), jenkins.plugins.elanceodesk:workplace-notifier (>=1.14, <=1.16) +7 more potentially affected by CVE-2021-21602 via org.jenkins-ci.main:jenkins-core (1.576)

org.jenkins-ci.main:jenkins-core MAVEN version 1.576 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.blazemeter.plugins:blazemeterjenkinsplugin =2.0, =1.14, =1.14, =1.5, =1.6 Source cves:...

GHSA-VPJM-58CW-R8Q5 Arbitrary file read vulnerability in workspace browsers in Jenkins

The file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier. This allows attackers with Job/Workspace permission and the ability to control workspac...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2020-2304 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2020-2304 Source...

Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2020-2161 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2020-2111 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2020-2111 Source...

Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file named .kube…config containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission. This temporary file is now created outside the regular project workspac...

VMware Workspace One Access Privilege Escalation

The vulnerability of the VMware Workspace One Access application management platform is related to lack of access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. Rapid7 Analysis...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

Privilege escalation

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22972

CVE-2022-22972 is an authentication bypass affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation. A malicious actor with network access to the UI could obtain administrative access without authentication. Public materials (CVEs, vendor advisories) confirm affected produ...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22973

CVE-2022-22973 is a local privilege escalation affecting VMware Workspace ONE Access and VMware Identity Manager. The root cause is improper permissions/handling in support scripts, permitting an attacker with local access to escalate to root. Affected product lines include Workspace ONE Access a...

CVE-2022-22972: Undefined Security Weakness

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...