380 matches found
Improper access control
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
CVE-2023-47321
CVE-2023-47321 concerns Silverpeas Core 6.3.1, describing an Incorrect Access Control vulnerability via the Porlet Deployer that allows administrators to deploy .WAR portlets . The issue is characterized by a high integrity impact with no confidentiality or availability impact per the provided me...
Silverpeas Security Vulnerabilities
Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums, and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the vulnerability of the Porlet Deployer to incorrect...
PT-2023-30414
Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The issue is related to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. Recommendations For Silverpeas Core version 6.3.1, consider restricting...
CVE-2023-47321
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
CVE-2023-47321
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
CVE-2023-47321
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
registerWallet() does not validate the sender
Lines of code Vulnerability details Issue registerWallet in WalletRegistry.sol does not guarantee that the sender is the safe deployer. registerWallet should be called from the safe deployer, in the context of deployConsoleAccount // Register Wallet /// @dev This function is being packed as a par...
Unauthorized account can update policy of any account without a policy
Lines of code Vulnerability details Impact Unauthorized account can update policy of any account without a policy Proof of Concept if currentCommit == bytes320 && msg.sender == AddressProviderService.getAuthorizedAddressSAFEDEPLOYERHASH The argument passed into getAuthorizedAddress -...
[Medium - 2] A force deployed contract may be stuck in the constructor forever
Lines of code Vulnerability details Impact The forceDeployOnAddress function in the ContractDeployer contract may be used to redeploy contracts at a specified address. Very useful in the case of precompiles or system contracts upgrades for instance. In the deployment parameters, multiple values c...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Science 1.22.1 security update
An update for kubeflow, dashboard, deployer is now available for Red Hat OpenShift Data Science 1.22. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
The vulnerability of the Controller File System Handler component in the Jenkins OpenShift Deployer Plugin allows a hacker to bypass established security restrictions and escalate their privileges.
The vulnerability of the Controller File System Handler component in the Jenkins OpenShift Deployer Plugin is related to authentication errors. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions and escalate their privileges...
The vulnerability of the Jenkins OpenShift Deployer Plugin, related to authentication errors, allows attackers to circumvent existing security restrictions and increase their privileges.
The vulnerability of the Jenkins OpenShift Deployer Plugin is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions and gain increased privileges...
[NAZ-M2] MINTER_ROLE Can Be Granted By The Deployer and Can Mint Arbitrary Amount of Tokens
Lines of code Vulnerability details Impact If the private key of the deployer or an address with the MINTER is compromised, the attacker will be able to mint an unlimited amount of tokens. I believe this is unnecessary and poses a serious centralization risk. Tools Used Manual Review Recommended...
Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.15 / 2.346.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2022-07-27)
The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.15, or 2.x prior to 2.346.2.3. It is, therefore, affected by multiple vulnerabilities, including the following: - A cross-site request forgery CSRF vulnerability in Jenki...
Security Bulletin: IBM Workload Deployer - Security vulnerability found in the command-line interface (CVE-2013-5455)
Abstract A security vulnerability found in the command-line interface allows users with read-only rights to delete, start, and stop any virtual system. Content Authenticated users of IBM Workload Deployer 3.1.0.0 and later with lesser privilege roles can use the command-line interface to perform...
GHSA-F7FQ-WP2X-JC25 Jenkins WildFly Deployer Plugin vulnerable to path traversal
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide...
Jenkins WildFly Deployer Plugin vulnerable to path traversal
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide...
