GHSA-R5M2-G5GC-Q43R Jenkins Denial of Service vulnerability

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service thread consumption via vectors related to a CLI handshake...

GHSA-FVFH-8MJ3-23XJ Jenkins allows for Code Execution via Crafted Packet to the CLI

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel...

CodeIgniter arbitrary code execution

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...

GHSA-V759-3FH9-84MX Jenkins directory traversal vulnerability

Directory traversal vulnerability in the CLI job creation hudson/cli/CreateJobCommand.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name...

Fedora: Security Advisory for chafa (FEDORA-2022-0aab67e874)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fidelis Network and Deception 命令注入漏洞

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A security vulnerability exists in Fidelis...

The vulnerability of the command-line processor of the NGINX Ingress Controller, which allows a hacker to disclose protected information.

The vulnerability of the command-line processor of the NGINX Ingress Controller monitoring and application management platform is related to insufficient checks for granting permissions to critical resources. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

[SECURITY] Fedora 35 Update: clamav-0.103.6-1.fc35

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 34 Update: clamav-0.103.6-1.fc34

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

ROS-20220516-30

Vulnerability in the cURL command line utility is related to OAUTH2 connection reuse errors for SASL-enabled protocols such as SMPTPS, IMAPS, POP3S, and LDAPS openldap only. Exploitation of the vulnerability could allow an attacker acting remotely to reuse the OAUTH2 authenticated connections...

Jenkins has CRLF Injection Vulnerability in the CLI

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

GHSA-W9VV-FVW8-J6Q3 codders-dataset Process Table Local Plaintext Credential Disclosure

lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby both place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

GHSA-5G7F-P7JG-V6MV lean-ruport allows local users to obtain sensitive information by listing the process

test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

GHSA-QFWQ-CHF4-JVWG karo Metacharacter Handling Remote Command Execution

The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field. A flaw in db.rb is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. In particular lines 76 and 95 as of 2014-06-01 pass unsanitized user supplied input to...

GHSA-89C9-3758-737W keycloak-httpd-client-install Insecure Secrets

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

keycloak-httpd-client-install Insecure Secrets

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

GHSA-4653-RMCH-3G2G Jenkins has Information Disclosure via Sidepanel Widget

The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages...

Information Exposure

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Information Exposure via the sidepanel widgets in the CLI command overview and help pages. An attacker can obtain sensitive information by making a direct request to...

GHSA-742J-JCFR-23W3 Insufficient Session Expiration in Jenkins

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based...