money-market-contracts::overseer: Market ltv is not capped

Lines of code Vulnerability details Impact There is no check to ensure that maxltv is less than 100% Decimal::One. It is therefore possible to set a collateral factor of 1, allowing anyone to borrow more than the collateral value ie. enabling under-collateralized loans. While the likelihood of...

Denial of service

Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-32794

ArchiSteamFarm is a C application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code POST /Api/ASF ASF API endpoint responsible for updating global ASF config incorrectly removed IPCPassword from the resulting config when the caller did not...

CVE-2021-21605

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...

PT-2021-14657 · Jenkins · Jenkins Bumblebee Hp Alm Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Bumblebee HP ALM Plugin versions 4.1.5 and earlier Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the credentials are...

PT-2021-14655 · Jenkins · Jenkins Tracetronic Ecu-Test Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TraceTronic ECU-TEST Plugin versions 2.23.1 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file on the Jenkins controller, making them accessible to users with access to the...

PT-2020-15527 · Jenkins · Jenkins Sms Notification Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SMS Notification Plugin versions 1.2 and earlier Description: The issue concerns the storage of an access token in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the file...

Design/Logic Flaw

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

Navigate CMS 2.8.7 - Authenticated Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Navigate CMS 2.8.7 - Authenticated Directory Traversal Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link:...

Navigate CMS 2.8.7 Directory Traversal

Exploit Title: Navigate CMS 2.8.7 - Authenticated Directory Traversal Date: 2020-06-04 Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download Version: 2.8.7 Tested o...

Unspecified Vulnerability in CloudBees Jenkins Zulip Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Zulip Plugin is used in one of the live chat...

PT-2019-11870 · Jenkins · Jenkins Zulip Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zulip Plugin versions 1.1.0 and earlier Jenkins Zulip Plugin versions prior to 1.1.1 Description: The issue allows stored credentials to be viewed unencrypted in the global configuration file on the Jenkins master. This could be...

PT-2019-11813 · Vmware +2 · Vfabric Application Director Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins vFabric Application Director Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins master. Specifically, the...

PT-2019-11704 · Jenkins · Jenkins Jira-Ext Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins jira-ext Plugin versions 0.8 and earlier Description: The issue concerns the storage of credentials in the global configuration file on the Jenkins master. Specifically, credentials are stored unencrypted in the file...

CVE-2019-1003051

Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

PT-2019-11387 · Jenkins · Jenkins Crowd Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Crowd Integration Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global config.xml configuration file on the Jenkins master. This allows users with...

PT-2019-11354 · Jenkins · Jenkins Aws-Device-Farm Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins aws-device-farm Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins aws-device-farm Plugin. Specifically,...

PT-2019-11700 · Jenkins · Jenkins Koji Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Koji Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, credentials are...

PT-2019-11342 · Jenkins · Jenkins Aws Elastic Beanstalk Publisher Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins AWS Elastic Beanstalk Publisher Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller...

PT-2019-11690 · Jenkins · Jenkins Jabber Server Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Jabber Server Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, credentia...