CVE-2023-32982

Jenkins Ansible Plugin 204.v8191fd551ebf and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2023-32983

Jenkins Ansible Plugin 204.v8191fd551ebf and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them...

CVE-2023-32983

Jenkins Ansible Plugin 204.v8191fd551ebf and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them...

CVE-2023-32982

Jenkins Ansible Plugin 204.v8191fd551ebf and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

PT-2023-24115 · Jenkins · Jenkins Ansible Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier Description: The issue concerns the storage of extra variables, often used to pass secrets, in an unencrypted manner in job config.xml files on the Jenkins controller. These...

PT-2023-24116 · Jenkins · Jenkins Ansible Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ansible Plugin versions 204.v8191fd551eb f and earlier Description: The issue concerns the Jenkins Ansible Plugin, which allows the specification of extra variables that can be passed to Ansible, commonly used to pass secrets. These...

Secrets stored and displayed in plain text by ansible

ansible allows the specification of extra variables that can be passed to Ansible. These extra variables are commonly used to pass secrets. ansible 204.v8191fd551ebf and earlier stores these extra variables unencrypted in job config.xml files on the Jenkins controller as part of its configuration...

USN-6067-1 neutron vulnerabilities

David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2021-20267...

CVE-2023-31139 DHIS2 Core unrestricted session cookies with Personal Access Tokens

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens PATs generate unrestricted session cookies. This may lead to a bypass of other access...

kernel: NFSD: Finish converting the NFSv2 GETACL result encoder

A flaw was identified in the Linux kernel’s NFSD NFSv2 GETACL result encoder. During conversion to xdrstream, leftover code erroneously set the pagelen field of the send buffer. The XDR stream encoders are expected to manage buffer length automatically, and the incorrect manual setting can result...

CVE-2022-48378

In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges...

CVE-2022-48384

In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2022-48371

In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...

CVE-2022-48375

In contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges...

CVE-2022-48370

In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...

CVE-2022-48243

In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2022-48242

In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...

CVE-2022-47490

In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges...

CVE-2022-38685

In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional execution privileges needed...

EulerOS Virtualization 3.0.2.0 : mariadb (EulerOS-SA-2023-1704)

According to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657 -...