CVE-2022-34799

Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

PT-2022-22359 · Jenkins · Jenkins Elasticsearch Query Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Elasticsearch Query Plugin versions 1.2 and earlier Description: The issue concerns the storage of a password in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the password is stored ...

PT-2022-22368 · Hewlett Packard +1 · Jenkins Hpe Network Virtualization Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HPE Network Virtualization Plugin version 1.0 Description: The issue concerns the storage of passwords in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the...

Jenkins Plugin RQM 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could exploit this vulnerability to allow a user with access to t...

CVE-2022-34199

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34202

Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34202

Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

SoftGuard SNMP Network Management Extension HTML Injection / File Download

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: SoftGuard SNMP Network Management Extension vulnerable version: SoftGuard Web SGW 5.1.5 fixed version: SoftGuard version 5.1.5 from...

Server side request forgery (ssrf)

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

CVE-2022-23071 Recipes - SSRF on Import

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

CVE-2022-24562

In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system with admin privileges on the victim's endpoint, which can result in data theft and remote code execution...

Remote code execution

In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system with admin privileges on the victim's endpoint, which can result in data theft and remote code execution...

PT-2022-16718

Name of the Vulnerable Software and Affected Versions IOBit IOTransfer version 4.3.1.1561 Description The issue allows an unauthenticated attacker to send GET and POST requests to Airserv, resulting in arbitrary read/write access to the entire file-system with admin privileges on the victim's...

IOBit IOTransfer 访问控制错误漏洞

IOBit IOTransfer is an easy-to-use iOS file transfer tool, phone cleaner, and video downloader from IOBit. Easily transfer/sync/move/backup photos, music, videos, contacts and more. An Access Control Error vulnerability exists in IOBit IOTransfer version 4.3.1.1561, which can be exploited by an...

CVE-2022-31219 Drive Composer Link Following Local Privilege Escalation Vulnerability

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation o...

ABB Automation 后置链接漏洞

ABB Automation is an automation solution from ABB. ABB has a security vulnerability that originates from allowing a low-privileged attacker to create and write files anywhere on the file system, the following products and versions are affected: ABB Automation versions 1.1.0 through 2.5.0...

ABB Mint WorkBench 安全漏洞

ABB Mint WorkBench is a single Windows tool from ABB Switzerland that is compatible with the ABB family of motion controllers and servo drives. A security vulnerability exists in ABB Mint WorkBench 5866 and prior versions that originated from allowing a low-privileged attacker to create and write...

CVE-2022-31216

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation o...

CVE-2022-24429 Arbitrary Code Injection

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...