CVE-2018-1000505

Tooltipy (tooltips for WP) version 5 contains a Cross-Site Request Forgery (CSRF) vulnerability in the Settings page that could allow an attacker to cause a post to be duplicated. The issue is exploitable via a link the admin must follow, and affects the plugin’s 5.x line. It is stated to be fixe...

CVE-2017-1000505

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type...

CVE-2017-1000505

In Jenkins Script Security Plugin versions 1.36 and earlier, users who can configure sandboxed Groovy scripts could abuse a Groovy type coercion to create new File objects from strings, enabling reading arbitrary files on the Jenkins master filesystem. The entry notes this type coercion is now tr...

CVE-2017-1000505

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +240 more potentially affected by CVE-2017-1000505 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.34)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2017-1000505 Source advisory: MEND:CVE-2017-1000505...