3806 matches found
Jenkins Plugin AWS CodeCommit Trigger 安全漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A security...
PT-2023-25166 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction...
CVE-2023-35147: Incorrect Permission Assignment for Critical Resource
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system...
Arbitrary file read vulnerability in aws-codecommit-trigger
aws-codecommit-trigger allows downloading activity logs of AWS Simple Queue Service SQS queues. aws-codecommit-trigger 3.0.12 and earlier does not restrict the queue name path parameter in the corresponding HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of...
CVE-2023-33660
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copynstr in the file mqttparser.c. An attacker could exploit this vulnerability to cause a denial of service attack...
GetSimple CMS v3.3.16 - Remote Code Execution Exploit
Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution RCE Exploit Author : Youssef Muhammad Vendor: Get-simple Software Link: Version app: 3.3.16 Tested on: linux CVE: CVE-2022-41544 import sys import hashlib import re import requests from xml.etree import ElementTree from threading import...
CVE-2018-16850 - SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.More at:...
CVE-2023-23759
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process impact is limited to...
Design/Logic Flaw
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process impact is limited to...
io.jenkins.plugins:amqp-build-trigger (1.0) potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.12.2)
org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.plugins:amqp-build-trigger 1.0 Source cves: CVE-2023-32977...
DEBIAN-CVE-2023-31622
An issue in the sqlcmakepolicytrig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
UBUNTU-CVE-2023-31622
An issue in the sqlcmakepolicytrig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2022-46378
An out-of-bounds read vulnerability exists in the PORT command parameter extraction functionality of Weston Embedded uC-FTPs v 1.98.00. A specially-crafted set of network packets can lead to denial of service. An attacker can send packets to trigger this vulnerability.This vulnerability occurs wh...
SEO ALert <= 1.59 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to Vanilla Beans » SEO Alert. 2. In "Slack...
VulnCheck KEV: CVE-2023-24055
KeePass through 2.53 in a default installation allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has...
CVE-2022-37306
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...
Cross site scripting
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...
CVE-2022-37306
OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger...
CVE-2022-37306
OX App Suite (Open-Xchange) vulnerable before 7.10.6-rev30 to cross-site scripting via an upsell trigger. Affected file/component: OX App Suite web interface; root cause: improper sanitization in upsell-trigger handling leading to XSS. Versions prior to 7.10.6-rev30 are impacted; update to 7.10.6...