Jenkins REST APIs vulnerable to clickjacking

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the X-Frame-Options: deny HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2019-10352 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

PT-2022-10483 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow versions prior to 2.0.35.SP1 Undertow versions prior to 2.0.36.SP1 Undertow versions prior to 2.0.39.Final Undertow versions prior to 2.2.6.SP1 Undertow versions prior to 2.2.7.SP1 Undertow versions prior to 2.2.9.Final Description: ...

Firefox ESR Thunderbird Isolated iframe Bypass

The vulnerability in the isolated iframe environment of Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to an incorrect limitation on the number of visible layers or frames. Exploiting this vulnerability allows a malicious actor to bypass existing security...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

DEBIAN-CVE-2022-29021

A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

DEBIAN-CVE-2022-29023

A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

DEBIAN-CVE-2022-29022

A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

UBUNTU-CVE-2022-29023

A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

UBUNTU-CVE-2022-29022

A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

PT-2022-19370 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions up to v3.3.0 Description: A buffer overflow issue exists in the razeraccessory driver, allowing attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrix custo...

OpenRazer security vulnerabilities

OpenRazer is an open source driver and userspace daemon. It is used to control Razer lighting and other features on GNU/Linux. A security vulnerability exists in OpenRazer version 3.3.0 and prior versions, which stems from a buffer overflow in the razerkbd driver. An attacker could exploit this...

OpenRazer security vulnerabilities

OpenRazer is an open source driver and userspace daemon. It is used to control Razer lighting and other features on GNU/Linux. A security vulnerability exists in OpenRazer version 3.3.0 and prior versions, which originates from a buffer overflow in the razermouse driver. An attacker could exploit...

Trudesk security vulnerabilities

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame, USA. A security vulnerability exists in versions prior to Trudesk 1.2.2, which stems from an improper restriction in the UI layer or frames...

PT-2022-19371 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions prior to v3.3.0 Description: A buffer overflow issue exists in the razermouse driver, allowing attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrix custom...

PT-2022-19369 · Openrazer +1 · Openrazer +1

Name of the Vulnerable Software and Affected Versions: OpenRazer versions up to v3.3.0 Description: A buffer overflow issue exists in the razerkbd driver, allowing attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the "matrix custom...

flac:fuzzer_decoder: Use-of-uninitialized-value in frame_sync_

Project: https://github.com/xiph/flac.git Detailed Report: https://oss-fuzz.com/testcase?key=4767463432126464 Project: flac Fuzzing Engine: libFuzzer Fuzz Target: fuzzerdecoder Job Type: libfuzzermsanflac Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept 1. Go to this URL:...