CVE-2025-31720

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration...

CVE-2025-31720

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration...

[R1] Nessus Agent Version 10.7.4 Fixes One Vulnerability

R1 Nessus Agent Version 10.7.4 Fixes One Vulnerability Arnie Cabral Wed, 04/02/2025 - 11:12 When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.7.4 did not enforce secure permissions for sub-directories. This could allow for local privilege...

CVE-2025-31720

A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration...

CVE-2025-31720

CVE-2025-31720 affects Jenkins core: versions 2.503 and earlier (and LTS 2.492.2 and earlier) expose a missing permission check on an HTTP endpoint, allowing attackers with Computer/Create permission but without Computer/Extended Read to copy an agent and access its configuration. The issue stems...

Rational Astrologies and Security

John Kelsey and I wrote a short paper for the Rossfest Festschrift: "Rational Astrologies and Security": There is another non-security way that designers can spend their security budget: on making their own lives easier. Many of these fall into the category of what has been called rational...

AWS VDP: Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

The Amazon Pinpoint SMS and Voice, version 2 service was found to incorrectly report the user-agent and network information as "AWS Internal" for five specific API endpoints that are FIPS endpoints. This issue was discovered to be similar to a previous bug reported for the Comprehend Medical and...

[SECURITY] Fedora 40 Update: rust-zincati-0.0.30-1.fc40

Update agent for Fedora CoreOS...

[SECURITY] Fedora 41 Update: rust-zincati-0.0.30-1.fc41

Update agent for Fedora CoreOS...

PT-2025-14511 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier Description: A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gainin...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins 2.503 and earlier and LTS 2.492.2 and earlier, which stems from a lack of...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description Medium SECURITY-3512 / CVE-2025-31720 Missing permission check allows retrieving agent configurations Description Medium SECURITY-3513 / CVE-2025-31721 Missing permission check allows retrieving secrets from agent configurations...

Jenkins LTS < 2.492.3 / Jenkins weekly < 2.504 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.492.3 or Jenkins weekly prior to 2.504. It is, therefore, affected by multiple vulnerabilities: - A missing permission check in Jenkins 2.503 and earlier, LTS 2.492...

Linux Virtual Delivery Agent - ICA session crashes when resizing

When resizing the ICA Session Window, users might see that the session crashes...

HCL Launch和HCL DevOps Deploy 访问控制错误漏洞

HCL Launch and HCL DevOps Deploy are both products of HCL India.HCL Launch is a multi-functional, enterprise-grade continuous delivery automation software. Used to handle the most complex deployment processes in DevOps.HCL DevOps Deploy is an application. Can be mapped to your organizational...

CVE-2025-27149 Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

The vulnerability of the agent’s integration module in the Cloud Profile of the Continuous Integration and Delivery Application System (CI/CD) of JetBrains TeamCity allows a hacker to disclose protected information.

The vulnerability of the agent’s integration module in the Cloud Profile of the Continuous Integration and Delivery Application System CI/CD of JetBrains TeamCity is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow a malicious actor to disclose...

CVE-2025-2782

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system. This issue affects Terminal Services Agent: from...

CVE-2024-56469

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1 could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay...

CVE-2025-2782

The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system...