Jenkins plugins Multiple Vulnerabilities (2022-12-07)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. CVE-2022-46682 - Jenki...

Malicious code in developer_backup_test523 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a102fc358a2f397cc33b778fdc8edcca752c4a93e273f3e728d9e936ef75cbff Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-8008 Malicious code in @rocketrefer/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0c06dd93e949e2750017a45685b6d200640e259c416cb4cbc995550ea3e04ab0 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in kiwi_vicious (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 24d3a7f0211bfcde4618961d390577b0a47d7aab36c363af84243b2427fc1c51 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in cnp_al_corp_front (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ca87bb9f11572bb7178a087d94273972886a104b0d9f9b25ea8799b418f8c85c Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

The vulnerability of the Checkmarx plugin in the Jenkins automation server allows a attacker to execute a “man-in-the-middle” attack.

The vulnerability of the Checkmarx server automation plugin for Jenkins is related to errors during the verification of SSL/TLS certificates. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

MAL-2023-107 Malicious code in assets-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e513e7556846ca62fa4d27646eef928d55f2c2954ce9caa51dd63643e2adf445 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Introducing AI-guided Remediation for IaC Security / KICS

While the use of Infrastructure as Code IaC has gained significant popularity as organizations embrace cloud computing and DevOps practices, the speed and flexibility that IaC provides can also introduce the potential for misconfigurations and security vulnerabilities. IaC allows organizations to...

Jenkins plugins Multiple Vulnerabilities (2023-06-14)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. CVE-2023-3514...

SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

GHSA-RR3P-5FCF-V5M3 SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

Design/Logic Flaw

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

CVE-2023-35142 affects Jenkins Checkmarx Plugin up to version 2022.4.3, where SSL/TLS certificate validation is disabled by default for connections to the Checkmarx server. The issue, documented in multiple sources (NVD/NASL/Tenable, OSV, CVE lists), has a base CVSSv3.1 score of 8.1 (Network, Hig...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...