Cross site scripting

A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability...

CVE-2020-2169

A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability...

CVE-2020-2169

CVE-2020-2169 affects Jenkins Queue Cleanup Plugin version 1.3 and earlier, where a form validation endpoint fails to properly escape a query parameter displayed in an error message, causing a reflected XSS vulnerability. The issue is specific to the plugin’s web UI and can lead to client-side co...

PT-2020-2657 · Jenkins · Jenkins Queue Cleanup Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Queue cleanup Plugin versions 1.3 and earlier Description: The issue is related to a form validation endpoint in the Jenkins Queue cleanup Plugin that does not properly escape a query parameter displayed in an error message, resulting...

Paessler AG PRTG Network Monitor Remote Code Execution Vulnerability

Paessler AG PRTG Network Monitor is a full-featured network monitoring and management software from Paessler AG, Germany. A remote code execution vulnerability exists in versions prior to PRTG Network Monitor 19.4.54.1506, which stems from the program failing to perform sufficient cleanup...

Paessler PRTG Network Monitor Access Control Error Vulnerability

Paessler PRTG Network Monitor is a full-featured network monitoring and management software from the German company Paessler. A security vulnerability exists in PRTG Network Monitor version 19.1.49 and prior versions, which stems from the program failing to perform sufficient cleanup operations...

docker-compose-remote-api injection vulnerability

docker-compose-remote-api is a connection interface between Docker-Compose and the Docker Remote API. An injection vulnerability exists in docker-compose-remote-api 0.1.4 and earlier versions, which stems from the 'execserviceName, cmd, fnStdout, fnStderr, fnExit' function failing to clean up. Th...

closure-compiler-stream injection vulnerability

closure-compiler-stream is a stream interface to a closure compiler. A security vulnerability exists in closure-compiler-stream version 0.1.15 and earlier, which stems from the program failing to perform any cleanup operations on the user-controllable 'options' parameter. An attacker could use th...

gulp-styledocco injection vulnerability

gulp-styledocco is a package for generating documentation from stylesheets and style guide documentation. A security vulnerability exists in gulp-styledocco 0.0.3 and earlier versions, which stems from the program failing to clean up the 'options' parameter. An attacker can exploit this...

Microsoft Azure DevOps Server Cross-Site Scripting Vulnerability (CNVD-2020-19008)

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as sharing code, work tracking, and software distribution. A cross-site scripting vulnerability exists in Azure DevOps Server that stems from the...

Enpeem Command Execution Vulnerability

Enpeem is a lightweight package for programmatically accessing NPM. A security vulnerability exists in Enpeem 2.2.0 and earlier versions, which originates when the program sends the 'options.dir' parameter directly to the 'exec' function without performing any cleanup operations. The vulnerabilit...

PHP Null Pointer Dereference Vulnerability

PHP PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHPGroup and the open source community. The language is mainly used for Web development, supports a variety of databases and operating systems. A nu...

DEBIAN-CVE-2020-7062

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

Null pointer dereference

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

UBUNTU-CVE-2020-7062

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

CVE-2020-7062

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

The vulnerability of the WriteTIFFImage function in the program for reading and editing ImageMagick graphic files involves accessing confidential data beyond the buffer limit of memory. This allows attackers to gain access to sensitive information and cause system failures.

The vulnerability of the WriteTIFFImage function in the ImageMagick program, which is used for reading and editing graphic files, is related to the absence or incomplete cleaning of input data. Exploiting this vulnerability can allow a malicious actor to compromise data confidentiality, as well a...

compile-sass Remote Code Execution Vulnerability

compile-sass is a module for compiling SASS and saving it to CSS files on-the-fly using node-sass. A security vulnerability exists in compile-sass versions prior to 1.0.5, which stems from the program failing to clean up the 'setupCleanupOnExit cssPath' function in the dist/index.js file before t...

Unspecified vulnerability in MISP (CNVD-2020-16093)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.121 that stems from the...

Updated kernel packages fix security vulnerabilities

This update is based on upstream 5.4.17 and fixes at least the following security vulnerabilities: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running lin...