org.jenkins-ci.main:jenkins-test-harness (1.440), org.jenkins-ci.main:jenkins-war (1.440) +9 more potentially affected by CVE-2021-21602 via org.jenkins-ci.main:jenkins-core (1.440)

org.jenkins-ci.main:jenkins-core MAVEN version 1.440 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.440 - org.jenkins-ci.main:jenkins-war 1.440 -...

@5rabbits/create-lib (>=0.1.0, <=0.4.0), @5rabbits/create-react-lib (0.4.0) +174 more potentially affected by CVE-2020-8141 via dot (>=1.0.0, <=1.1.2)

dot NPM version =1.0.0, =0.1.0, =0.1.16-master.20181116180810, =0.1.0, =4.6.201910241203, =4.6.201905201019, =4.6.201906121726, =4.6.201908201256, =4.6.201907131632, =4.6.201908021805, =4.6.201905201531, =4.6.201907081200, =4.6.201908311200 and more Source cves: CVE-2020-8141 Source advisory:...

org.jenkins-ci.main:jenkins-test-harness (1.440), org.jenkins-ci.main:jenkins-war (1.440) +9 more potentially affected by CVE-2020-2104 via org.jenkins-ci.main:jenkins-core (1.440)

org.jenkins-ci.main:jenkins-core MAVEN version 1.440 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.440 - org.jenkins-ci.main:jenkins-war 1.440 -...

ROS-20220524-03

The cURL command-line utility vulnerability is related to the -no-clobber toolkit, which is used in conjunction with --remove-on-error. Exploitation of the vulnerability could allow an attacker acting remotely, trick the victim into connecting to a malicious server and forcing the command-line to...

CVE-2022-29002

A Cross-Site Request Forgery CSRF in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add...

CVE-2022-29002: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add...

@lowdefy/server (>=4.0.0-alpha.7, <=4.0.0-alpha.10), @lowdefy/server-dev (>=4.0.0-alpha.7, <=4.0.0-alpha.10) +4 more potentially affected by CVE-2022-29214 via next-auth (>=4.1.2, <=4.2.1)

next-auth NPM version =4.1.2, =4.0.0-alpha.7, =4.0.0-alpha.7, =0.31.1, =1.42.1, =0.50.4, =0.78.15-alpha.2 - chirpy-dev 0.1.0 Source cves: CVE-2022-29214 Source advisory: MEND:CVE-2022-29214...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +4 more potentially affected by CVE-2022-29214 via next-auth (>=0.0.0-manual.83c4ebd1, <=3.1.0)

next-auth NPM version =0.0.0-manual.83c4ebd1, =0.5.1, =0.57.0, =0.35.0, =1.1.0, =0.0.1, =0.0.5 Source cves: CVE-2022-29214 Source advisory: MEND:CVE-2022-29214...

RubyGems.org Authentication Bypass

The vulnerability of the RubyGems.org hosting service is related to authentication errors during data copying. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to create, modify, or delete data...

GHSA-64MC-2M9P-23C8 Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors...

PT-2022-36990

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a bad-cast to const upb tabent also known as const struct upb tabent. This occurs during the execution of the upb...

PostgreSQL Arbitrary SQL Execution

The vulnerabilities of the Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck components of the PostgreSQL database management system are related to errors that occur when one user manipulates objects for another user. Exploiting these vulnerabilities allows a...

CVE-2022-1089: Improper Neutralization of Input During Web Page Generation

The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13651

Name of the Vulnerable Software and Affected Versions Bulk Edit and Create User Profiles WordPress plugin versions prior to 1.5.14 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not proper...

GHSA-R57F-7XW3-Q2R9 Improper Authentication in Jenkins

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to...

Subrion CMS vulnerable to CSRF in admin/blocks/add

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

org.jenkins-ci.main:jenkins-test-harness (1.440), org.jenkins-ci.main:jenkins-war (1.440) +9 more potentially affected by CVE-2018-1999042 via org.jenkins-ci.main:jenkins-core (1.440)

org.jenkins-ci.main:jenkins-core MAVEN version 1.440 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.440 - org.jenkins-ci.main:jenkins-war 1.440 -...

org.jenkins-ci.main:jenkins-test-harness (1.440), org.jenkins-ci.main:jenkins-war (1.440) +9 more potentially affected by CVE-2018-1999045 via org.jenkins-ci.main:jenkins-core (1.440)

org.jenkins-ci.main:jenkins-core MAVEN version 1.440 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.440 - org.jenkins-ci.main:jenkins-war 1.440 -...

GHSA-9JCV-V4JP-W3CQ Cross-site Scripting in Jenkins Core

A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user's...

org.jenkins-ci.main:jenkins-test-harness (1.440), org.jenkins-ci.main:jenkins-war (1.440) +9 more potentially affected by CVE-2018-1000410 via org.jenkins-ci.main:jenkins-core (1.440)

org.jenkins-ci.main:jenkins-core MAVEN version 1.440 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.440 - org.jenkins-ci.main:jenkins-war 1.440 -...