GHSA-3H69-4FRW-G2JM Magento 2 Community Unrestricted File Upload

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

Magento 2 Community Unrestricted File Upload

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

Jenkins Maven Release Plug-in Plugin stored credentials in plain text

Jenkins Maven Release Plug-in Plugin stored credentials unencrypted in its global configuration file org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Maven Release...

GHSA-5HHG-Q22C-6G39 Jenkins Port Allocator Plugin stores credentials in plain text

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

Password in config file in KIE server

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services...

Jenkins Azure AD Plugin stored the client secret unencrypted

Jenkins Azure AD Plugin stored the client secret unencrypted in the global config.xml configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure AD Plugin now stores the client secret encrypted...

Jenkins Twitter Plugin stores credentials in plain text

Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

Jenkins Aqua MicroScanner Plugin stored credentials in plain text

Jenkins Aqua MicroScanner Plugin stored credentials unencrypted in its global configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Aqua MicroScanner Plugin now stores credentials encrypted...

CVE-2020-29600

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...

Rengine 安全漏洞

Rengine is an automated reconnaissance framework for gathering information during penetration testing of web applications. A security vulnerability exists in Rengine version 1.0.2, which stems from the discovery of a Remote Code Execution RCE vulnerability via the yaml configuration function...

CVE-2022-30018

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

ASP.NET Core Configuration File Detected

ASP.NET Core applications can read configuration data based on key-value pairs from multiple providers and sources. By using the JSON configuration provider, data can be retrieved from predictable configuration files named appsettings.json and appSettings.Environment.json. Developers sometimes...

Design/Logic Flaw

cmseasy V7.7.520211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file config / configdatabase can be read through this vulnerability...

GHSA-7F2C-VP52-GMFW OpenStack keystonemiddleware does not verify certificate

OpenStack keystonemiddleware formerly python-keystoneclient 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct man-in-the-middle...

PT-2022-19142 · Apport +2 · Apport +2

Name of the Vulnerable Software and Affected Versions: apport affected versions not specified Description: The /.config/apport/settings parsing is vulnerable to a "billion laughs" attack. This issue affects the parsing of settings in the apport configuration file, making it susceptible to a...

The vulnerability in the protection of configuration files of the Cisco Virtualized Infrastructure Manager (VIM) allows a perpetrator to access confidential information and enhance their privileges.

The vulnerability of the configuration file protection mechanism in the Cisco Virtualized Infrastructure Manager VIM is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain access to confidential information and enhance their privileges...

GHSA-R5M8-5MWX-CMJ8 CSRF vulnerability in Config File Provider Plugin

A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions...

Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

GHSA-PMC5-74W3-78MW Jenkins Config File Provider Plugin XSS vulnerability

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete t...

GHSA-R5JR-82X4-R6J7 Jenkins Crowd Integration Plugin stores credentials in plain text

Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...