355 matches found
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2011-5098
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...
CVE-2019-1003087
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...
CVE-2010-5142
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...
CVE-2024-9825
The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference IDOR by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the...
CVE-2024-9825 The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token
The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference IDOR by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the...
CVE-2024-9825 The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token
The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference IDOR by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the...
CVE-2024-9825
The CVE-2024-9825 entry concerns the Chef Habitat builder-api on-prem-builder package. It states that any version older than habitat/builder-api/10315/20240913162802 is vulnerable to an IDOR issue that allows unauthorized deletion of a personal token, with the vulnerability attributed to the buil...
Progress Chef Habitat 安全漏洞
Progress Chef Habitat is an open source solution from Progress, Inc. that provides automation capabilities for defining, packaging, and delivering applications to virtually any environment. Progress Chef Habitat has a security vulnerability that stems from susceptibility to Indirect Object...
CVE-2024-9825: Incorrect Authorization
The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference IDOR by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the...
Chef Infra Client SEoL (17.x)
According to its version, Chef Infra Client is 17.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...
Chef Infra Client SEoL (16.x)
According to its version, Chef Infra Client is 16.x or earlier. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVE...
Chef Web UI Brute Force Utility
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/chefwebui' require 'metasploit/framework/credentialcollection' class MetasploitModule 'Chef Web UI Brute Force Utility',...
Malicious code in chef_handler-statsd (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6828 Malicious code in chef_handler-statsd (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6827 Malicious code in chef_handler-datadog-demo (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in chef_handler-datadog-demo (RubyGems)
--- -= Per source details. Do not edit below this line.=-...