The vulnerability of the method for creating temporary catalogs in the programming language Apache Groovy, which allows attackers to exploit and disclose protected information

The vulnerability of the method for creating temporary catalogs in the programming language Apache Groovy is related to incorrect default access rights settings. Exploiting this vulnerability can allow an attacker to disclose protected information...

Exploit for CVE-2019-1003000

PoC exploit for CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002: Script Security, Pipeline: Groovy, Pipeline: Declarative. This PoC allows users with Overall/Read permission and Job/Configure and optional Job/Build to bypass the sandbox protection and execute arbitrary code on the Jenkins...

CVE-2020-17521

A flaw was found in Apache Groovy. Groovy makes use of a method for creating temporary directories which is not suitable for security-sensitive contexts and allows for sensitive information leakage. The highest threat from this vulnerability is to data confidentiality. Mitigation Setting the...

MobileIron MDM Hessian-Based Java Deserialization Remote Code Execution Exploit

This Metasploit module exploits an ACL bypass in MobileIron MDM products to execute a Groovy gadget against a Hessian-based Java deserialization endpoint. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MobileIron MDM Hessian-Based Java Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MobileIron MDM Hessian-Based Java Deserialization RCE', 'Description' = %q This module exploits an ACL bypass in MobileIron MDM products to execu...

openSUSE Security Update : groovy (openSUSE-2020-2367)

This update for groovy fixes the following issues : - groovy was updated to 2.4.21 - CVE-2020-17521: Fixed an information disclosure vulnerability bsc1179729. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and package...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

Crlf injection

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

CVE-2021-21248 Post-Auth Arbitrary Code execution via Groovy script injection

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

PT-2021-14358 · Onedev · Onedev

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform with a critical issue involving the build endpoint parameters. The InputSpec is used to define parameters of a Build spec, utilizing dynamically generated...

OPENSUSE-SU-2020:2367-1 Security update for groovy

This update for groovy fixes the following issues: - groovy was updated to 2.4.21 - CVE-2020-17521: Fixed an information disclosure vulnerability bsc1179729. This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security update for groovy (moderate)

openSUSE Security Update: Security update for groovy Announcement ID: openSUSE-SU-2020:2367-1 Rating: moderate References: 1179729 Cross-References: CVE-2020-17521 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for groovy...

Exploit for Injection in Elastic Elasticsearch

CVE-2015-5377 Elasticsearch 1.5.2 is vulner...

SUSE-SU-2020:3917-1 Security update for groovy

This update for groovy fixes the following issues: - groovy was updated to 2.4.21 - CVE-2020-17521: Fixed an information disclosure vulnerability bsc1179729...

Information Disclosure

groovy is vulnerable to information disclosure. The vulnerability exists when creating temporary directories through extension methods...

Apache Groovy Provides Resource Management Error Vulnerability

Apache Groovy is the United States Apache Apache Software Foundation of a Java-based platform for object-oriented programming language, which combines many powerful features of Python, Ruby and Smalltalk. A resource management error vulnerability exists in the Apache Groovy provides product that...

cn.ibizlab.plugin:ibiz-cloud-ai-baichuanai (>=8.1.0.371 <=8.1.0.578.187), cn.ibizlab.plugin:ibiz-cloud-ai-core (>=8.1.0.304 <=8.1.0.578.187) +438 more potentially affected by CVE-2020-17521 via org.codehaus.groovy:groovy-all (>=2.5.0 <=2.5.13)

org.codehaus.groovy:groovy-all MAVEN version =2.5.0, =8.1.0.371, =8.1.0.304, =8.1.0.371, =8.1.0.516, =8.1.0.304, =8.1.0.286, =8.1.0.286, =8.1.0.371, =8.1.0.371, =8.1.0.286, =8.1.0.286, =8.1.0.371, =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.567.22 and more Source cves: CVE-2020-17521 Source...

GHSA-RCJJ-H6GH-JF3R Information Disclosure in Apache Groovy

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the...