CVE-2023-27900

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

CVE-2023-27901: Allocation of Resources Without Limits or Throttling

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service...

CVE-2023-27900: Allocation of Resources Without Limits or Throttling

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service...

PT-2023-21406 · Apache +1 · Apache Commons Fileupload +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.393 and earlier Jenkins LTS versions 2.375.3 and earlier Description: The issue is related to the use of the Apache Commons FileUpload library without specifying limits for the number of request parts, allowing attackers to...

DoS vulnerability in bundled Apache Commons FileUpload library

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier is affected by the Apache Commons FileUpload library's vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-24998CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework usually through StaplerRequestgetFile...

Debian: Security Advisory (DLA-222-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-528-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-322-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Security Guardium is affected by the following vulnerabilities [CVE-2022-39166, CVE-2022-34917, CVE-2022-42889]

Summary IBM Security Guardium has addressed these vulnerabilities CVE-2022-39166, CVE-2022-34917, CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-39166 DESCRIPTION: IBM Security Guardium could allow a privileged user to obtain sensitive information inside of an HTTP response. CVSS Base score:...

Arbitrary File Read

jenkins-2-plugins is vulnerable to Arbitrary File Read. The library does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons configuration library that enable the file: prefix interpolator by default, allowing attackers to configure pipelines to read...

CVE-2022-4929

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

icplayer cross-site scripting vulnerability

icplayer is icplayer open source HTML5 player for an interactive course. A cross-site scripting vulnerability exists in versions prior to icplayer 0.819, which stems from a problem with the file addons/Commons/src/tts-utils.js, which can lead to cross-site scripting...

CVE-2022-4929: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is...

apache-commons-configuration:XMLConfigurationWriteFuzzer: Security exception in org.apache.commons.configuration2.XMLConfiguration.constructHierarchy

Detailed Report: https://oss-fuzz.com/testcase?key=5719814758072320 Project: apache-commons-configuration Fuzzing Engine: libFuzzer Fuzz Target: XMLConfigurationWriteFuzzer Job Type: libfuzzerasanapache-commons-configuration Platform Id: linux Crash Type: Security exception Crash Address: Crash...

org.wikbook:wikbook.maven (>=0.9.33, <=0.9.45), org.wikbook:wikbook.xwiki (>=0.9.33, <=0.9.45) +57 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=3.2-milestone-3, <=13.10.8)

org.xwiki.commons:xwiki-commons-xml MAVEN version =3.2-milestone-3, =0.9.33, =0.9.33, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =3.2-milestone-3, =3.2-milestone-3, =4.1-milestone-1, =3.2-milestone-3, =3.2-milestone-3, =4.2-milestone-3, =4.1-milestone-2,...

org.xwiki.commons:xwiki-commons-diff-script (>=14.0-rc-1, <=14.4.3), org.xwiki.commons:xwiki-commons-diff-xml (>=14.0-rc-1, <=14.4.3) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.0-rc-1, <=14.4.3)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.0-rc-1, =14.4.3 and more Source cves: CVE-2023-26055 Source...

org.xwiki.commons:xwiki-commons-diff-script (>=14.5, <=14.6), org.xwiki.commons:xwiki-commons-diff-xml (>=14.5, <=14.6) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.5, <=14.6)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.6 and more Source cves: CVE-2023-26055 Source advisory: GHSA-8CW6-4R32-6R3H...

org.xwiki.commons:xwiki-commons-diff-script (>=14.5, <=14.6), org.xwiki.commons:xwiki-commons-diff-xml (>=14.5, <=14.6) +22 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=14.5, <=14.6)

org.xwiki.commons:xwiki-commons-xml MAVEN version =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.5, =14.6 and more Source cves: CVE-2023-26055 Source advisory: OSV:GHSA-8CW6-4R32-6R3H...

org.wikbook:wikbook.maven (>=0.9.33, <=0.9.45), org.wikbook:wikbook.xwiki (>=0.9.33, <=0.9.45) +57 more potentially affected by CVE-2023-26055 via org.xwiki.commons:xwiki-commons-xml (>=3.2-milestone-3, <=13.10.8)

org.xwiki.commons:xwiki-commons-xml MAVEN version =3.2-milestone-3, =0.9.33, =0.9.33, =11.6-rc-1, =11.6-rc-1, =6.2-milestone-1, =5.2-milestone-1, =10.7-rc-1, =3.2-milestone-3, =3.2-milestone-3, =4.1-milestone-1, =3.2-milestone-3, =3.2-milestone-3, =4.2-milestone-3, =4.1-milestone-2,...