CVE-2022-34806

Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34805

CVE-2022-34805 affects Jenkins Skype notifier Plugin versions 1.1.0 and earlier. The vulnerability is due to a password stored in plaintext in the plugin’s global configuration on the Jenkins controller, which can be viewed by anyone with filesystem access to the controller. Some sources specify ...

CVE-2022-34805

Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2022-34799

Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

PT-2022-22359 · Jenkins · Jenkins Elasticsearch Query Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Elasticsearch Query Plugin versions 1.2 and earlier Description: The issue concerns the storage of a password in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the password is stored ...

Jenkins Plugin RQM 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker could exploit this vulnerability to allow a user with access to t...

PT-2022-22368 · Hewlett Packard +1 · Jenkins Hpe Network Virtualization Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HPE Network Virtualization Plugin version 1.0 Description: The issue concerns the storage of passwords in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the...

CVE-2022-34199

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34202

Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-34202

Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

SoftGuard SNMP Network Management Extension HTML Injection / File Download

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: SoftGuard SNMP Network Management Extension vulnerable version: SoftGuard Web SGW 5.1.5 fixed version: SoftGuard version 5.1.5 from...

Server side request forgery (ssrf)

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

CVE-2022-23071 Recipes - SSRF on Import

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery SSRF, in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information...

CVE-2022-24562

In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system with admin privileges on the victim's endpoint, which can result in data theft and remote code execution...

Remote code execution

In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system with admin privileges on the victim's endpoint, which can result in data theft and remote code execution...

PT-2022-16718

Name of the Vulnerable Software and Affected Versions IOBit IOTransfer version 4.3.1.1561 Description The issue allows an unauthenticated attacker to send GET and POST requests to Airserv, resulting in arbitrary read/write access to the entire file-system with admin privileges on the victim's...

IOBit IOTransfer 访问控制错误漏洞

IOBit IOTransfer is an easy-to-use iOS file transfer tool, phone cleaner, and video downloader from IOBit. Easily transfer/sync/move/backup photos, music, videos, contacts and more. An Access Control Error vulnerability exists in IOBit IOTransfer version 4.3.1.1561, which can be exploited by an...

CVE-2022-31219 Drive Composer Link Following Local Privilege Escalation Vulnerability

Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation o...

ABB Automation 后置链接漏洞

ABB Automation is an automation solution from ABB. ABB has a security vulnerability that originates from allowing a low-privileged attacker to create and write files anywhere on the file system, the following products and versions are affected: ABB Automation versions 1.1.0 through 2.5.0...