CVE-2019-12845

CVE-2019-12845 affects JetBrains TeamCity. The generated Kotlin DSL settings allowed artifacts to be resolved over an unencrypted connection, exposing potential MITM risks. Root cause: unencrypted artifact resolution in Kotlin DSL settings. Impact: exposure of artifact resolution traffic (no deta...

CVE-2019-12845

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3...

Sandbox Protection Bypass

Jenkins Job DSL Plugin is vulnerable to sandbox protection bypass vulnerability. This exists in the job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy and job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy and...

PT-2019-11708 · Jenkins · Jenkins Ontrack Jenkins Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins ontrack Plugin versions 3.4 and earlier Description: A sandbox bypass issue in the Jenkins ontrack Plugin allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM. Recommendations...

jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)

A flaw was found in the Jenkins Job DSL plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...

D-Link DSL-3782 Cross-Site Scripting Vulnerability

The D-Link DSL-3782 is a wireless router from AUO D-Link of Taiwan, China. A cross-site scripting vulnerability exists in the web interface of the D-Link DSL-3782 using firmware version 1.01, which stems from the lack of proper validation of client data by the WEB application. An attacker could...

CVE-2018-17989

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

CVE-2018-17990

An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter...

CVE-2018-17989

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

Command injection

An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter...

Cross site scripting

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

CVE-2018-17990

An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter...

CVE-2018-17990

CVE-2018-17990 affects D-Link DSL-3782 devices running firmware 1.01. The vulnerability is an OS command injection in Acl.asp that allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter. No exploitation details are provided in the connected docum...

CVE-2018-17989

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

CVE-2018-17989

CVE-2018-17989 affects D-Link DSL-3782 devices (firmware 1.01). A stored XSS vulnerability exists in the device’s web interface, allowing an authenticated attacker to inject a JavaScript/HTML payload into the ACL page. The payload executes when the browser requests "/cgi-bin/New_GUI/Acl.asp". Acc...

[SECURITY] Fedora 28 Update: php-twig-1.38.2-2.fc28

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

CVE-2019-1003034

A flaw was found in the Jenkins Job DSL plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...

CVE-2019-7391

CVE-2019-7391 concerns a CSRF vulnerability in ZyXEL VMG3312-B10B (DSL-491HNU-B1B v2) devices. The PoC shows a cross-site request forgery on the login-page.cgi endpoint, enabling an attacker to submit a login request with admin credentials (e.g., AuthName=admin, AuthPassword=1234) from a maliciou...

CVE-2019-1003034

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...

Security feature bypass

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy,...