Jenkins security vulnerabilities

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins XebiaLabs XL Deploy Plugin has a security vulnerability that stems from missing permission checks in Jenkins...

Security Bulletin: IBM UrbanCode Deploy (UCD) stores keystore passwords in plain after a manuel edit, which can be read by a local user.

Summary IBM UrbanCode Deploy UCD leaves a keystore passwords in plain text after a manual edit, which may be read by a local user. Vulnerability Details CVEID: CVE-2020-4944 DESCRIPTION: IBM UrbanCode Deploy UCD stores keystore passwords in plain in plain text after a manuel edit, which can be re...

CVE-2021-3495

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster to deploy a kiali operand to use this vulnerability and deploy a given image to anywhere in the cluster, potential...

Insecure Permissions in Gogs

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

Missing Authorization

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...

Kiali-operator security vulnerabilities

kiali-operator is a software application. It is used to build operator images and push the built images to Quay.io. A security vulnerability exists in Kiali-operator. The vulnerability allows an attacker to deploy a given image to any location in a cluster, potentially gaining access to privilege...

CVE-2021-29475

HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability t...

Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating

Summary XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. Vulnerability Details Refer t...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: OSV:GHSA-J6QJ-J888-VVGQ...

com.github.waffle:waffle-jetty (3.0.0), com.highstreet-technologies.ops4j.pax.web:pax-web-jetty (7.3.13) +170 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=9.4.32.v20200930, <=9.4.38.v20210224)

org.eclipse.jetty:jetty-deploy MAVEN version =9.4.32.v20200930, =1.10.4, =3.2.8, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =2.4.18, =2.4.25 - no.finn.search:solr-integrationtest-support 7.0 - org.apache.activemq.examples.rest:dup-send 2.17.0 -...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: OSV:GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: GHSA-J6QJ-J888-VVGQ...

com.github.waffle:waffle-jetty (3.0.0), com.highstreet-technologies.ops4j.pax.web:pax-web-jetty (7.3.13) +170 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=9.4.32.v20200930, <=9.4.38.v20210224)

org.eclipse.jetty:jetty-deploy MAVEN version =9.4.32.v20200930, =1.10.4, =3.2.8, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =4.2.11.hyte-42110, =2.4.18, =2.4.25 - no.finn.search:solr-integrationtest-support 7.0 - org.apache.activemq.examples.rest:dup-send 2.17.0 -...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: GHSA-J6QJ-J888-VVGQ...

Directory Traversal

jetty-deploy is vulnerable to directory traversal. The vulnerability exists through the WebAppProvider filter as it does not canonicalize files passed in from the scanner, allowing access to files outside of its working directory...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

IBM UrbanCode Deploy elevation of privilege vulnerability (CNVD-2021-26382)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2021-24459)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2021-24460)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...