20609 matches found
jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE
A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...
jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE
A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...
CVE-2024-25157
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification...
CVE-2024-25157 Authentication bypass in GoAnywhere MFT prior to 7.6.0
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification...
PT-2024-20790 · Helpsystems · Goanywhere Mft
Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 7.6.0 Description: An authentication bypass issue allows Admin Users with access to the Agent Console to circumvent some permission checks, potentially leading to unauthorized information disclosure or...
Vulnerabilities fixed in Microsoft Azure components
Microsoft has fixed vulnerabilities in several Azure components. A malicious party can exploit the vulnerabilities to grant themselves elevated privileges or impersonate another user. For successful abuse, the malicious party needs prior access to the vulnerable environment, or the malicious part...
CVE-2024-38162
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2024-38162
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2024-38098
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2024-38098
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2024-38098 Azure Connected Machine Agent Elevation of Privilege Vulnerability
...
Azure Connected Machine Agent Elevation of Privilege Vulnerability
...
Azure Connected Machine Agent Elevation of Privilege Vulnerability
...
PT-2024-27895 · Microsoft · Azure Connected Machine Agent
Name of the Vulnerable Software and Affected Versions: Azure Connected Machine Agent affected versions not specified Description: The issue is related to an Elevation of Privilege Vulnerability in the Azure Connected Machine Agent. Recommendations: At the moment, there is no information about a...
Microsoft Azure Connected Machine Agent 后置链接漏洞
Microsoft Azure Connected Machine Agent is a U.S.-based Microsoft company's ability to manage Windows and Linux computers hosted outside of Azure on a corporate network or other cloud provider. A backlink vulnerability exists in Microsoft Azure Connected Machine Agent. An attacker could exploit t...
Microsoft Azure Connected Machine Agent 访问控制错误漏洞
Microsoft Azure Connected Machine Agent is a U.S. Microsoft Corporation's ability to manage Windows and Linux computers hosted outside of Azure on a corporate network or other cloud provider. An access control error vulnerability exists in Microsoft Azure Connected Machine Agent. An attacker coul...
Security Updates for Azure Connected Machine Agent (August 2024)
The Microsoft Azure Connected Machine Agent running on the remote host is prior to 1.44. It is, therefore affected by an elevation of privilege vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVE...
CVE-2024-5445
Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...
CVE-2024-37283
An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs...
