CVE-2019-10395

Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties...

CVE-2019-15747

SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient checks on the server side...

CVE-2019-15751

An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file containing PHP code to execute operating system commands...

CVE-2019-10396

Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions...

CVE-2011-0466

The API in SUSE openSUSE Build Service OBS 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a 1 package or 2 project via unspecified vectors...

CVE-2011-0462

Multiple cross-site scripting XSS vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service OBS before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

SUSE-SU-2025:20336-1 Security update for ca-certificates-mozilla

This update for ca-certificates-mozilla fixes the following issues: - test for a concretely missing certificate rather than just the directory, as the latter is now also provided by openssl-3 - Re-create java-cacerts with SOURCEDATEEPOCH set for reproducible builds bsc1229003 - explicit remove...

📄 ABB Cylon FLXeon 9.3.5 variant.js Information Disclosure

The ABB Cylon FLXeon BACnet controller's /api/variant endpoint exposes sensitive system information, including the internal IP address, MAC address, device model, and build type, without requiring authentication. The get function gathers network interface data using the os.networkInterfaces API a...

Schneider Electric EcoStruxure Power Build Rapsody Buffer Overflow

The vulnerability of Schneider Electric EcoStruxure Power Build Rapsody software for electrical system design and configuration is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created malicious file...

CISA Releases Thirteen Industrial Control Systems Advisories

CISA released thirteen Industrial Control Systems ICS advisories on May 20, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-140-01 ABUP IoT Cloud Platform ICSA-25-140-02 National Instruments Circuit Design Sui...

Duping Cloud Functions: An emerging serverless attack vector

Summary and background Google Cloud Platform GCP Cloud Functions are event-triggered, serverless functions that automatically scale and execute code in response to specific events like Hypertext Transfer Protocol HTTP requests or data changes. Tenable Research published an article discussing a...

scikit-build (0.2.0) potentially affected by CVE-2025-47273 via setuptools (25.0.0)

setuptools PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.2.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

scikit-build (0.3.0) potentially affected by CVE-2025-47273 via setuptools (27.2.0)

setuptools PYPI version 27.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.3.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

abtests (>=0.0.1, <=0.0.2.1), scikit-build (0.4.0) potentially affected by CVE-2025-47273 via setuptools (28.3.0)

setuptools PYPI version 28.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - abtests =0.0.1, =0.0.2.1 - scikit-build 0.4.0 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

build-vocabulary (0.1.8) potentially affected by CVE-2025-47273 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

scikit-build (0.2.0) potentially affected by CVE-2025-47273 via setuptools (25.0.0)

setuptools PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.2.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

scikit-build (0.3.0) potentially affected by CVE-2025-47273 via setuptools (27.2.0)

setuptools PYPI version 27.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.3.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

abtests (>=0.0.1, <=0.0.2.1), scikit-build (0.4.0) potentially affected by CVE-2025-47273 via setuptools (28.3.0)

setuptools PYPI version 28.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - abtests =0.0.1, =0.0.2.1 - scikit-build 0.4.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

build-vocabulary (0.1.8) potentially affected by CVE-2025-47273 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

CVE-2025-47884

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...