Exploit for Improper Access Control in Apache Hugegraph

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE...

RHEL 7 : groovy (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Apache Groovy: Remote code execution via deserialization CVE-2016-6814 Note that Nessus has not tested for this iss...

PT-2024-35773 · Anji Plus · Anji-Plus Aj-Report

Name of the Vulnerable Software and Affected Versions: anji-plus AJ-Report versions up to 1.4.1 Description: A critical issue has been found in the affected software, affecting the IGroovyHandler function. This issue leads to command injection and can be initiated remotely. The exploit has been...

CVE-2024-34145

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin within the sandbox-defined classes, enabling the circumvention of security restrictions. This flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protecti...

Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call ...

GHSA-V63G-V339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call ...

org.jvnet.hudson.plugins:groovy-postbuild (>=2.0, <=2.2.2) potentially affected by CVE-2024-34144 via org.jenkins-ci.plugins:script-security (1.5)

org.jenkins-ci.plugins:script-security MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jvnet.hudson.plugins:groovy-postbuild =2.0, =2.2.2 Source cves: CVE-2024-34144...

org.jenkins-ci.plugins:groovy (2.1) potentially affected by CVE-2024-34144 via org.jenkins-ci.plugins:script-security (1.50)

org.jenkins-ci.plugins:script-security MAVEN version 1.50 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:groovy 2.1 Source cves: CVE-2024-34144 Source advisory:...

org.jenkins-ci.plugins:groovy (2.1) potentially affected by CVE-2024-34145 via org.jenkins-ci.plugins:script-security (1.50)

org.jenkins-ci.plugins:script-security MAVEN version 1.50 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:groovy 2.1 Source cves: CVE-2024-34145 Source advisory:...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.12, <=1.27.16), io.jenkins.plugins:coverage (>=1.11.0, <=1.16.1) +6 more potentially affected by CVE-2024-34145 via org.jenkins-ci.plugins:script-security (1305.v487433146192)

org.jenkins-ci.plugins:script-security MAVEN version 1305.v487433146192 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.12, =1.11.0,...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=90.vf089ff0feff9), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +4 more potentially affected by CVE-2024-34145 via org.jenkins-ci.plugins:script-security (1326.vdb_c154de8669)

org.jenkins-ci.plugins:script-security MAVEN version 1326.vdbc154de8669 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history =44.va44d94c22f21,...

io.jenkins.plugins:zohosprints (>=1.0, <=1.1.4), org.jenkins-ci.plugins:build-name-setter (2.0.4) +6 more potentially affected by CVE-2024-34145 via org.jenkins-ci.plugins:script-security (1.54)

org.jenkins-ci.plugins:script-security MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:zohosprints =1.0, =2.4, =2.62.1, =2.2, =1.78, =2.0.0, =1.14,...

RHEL 8 : OpenShift Developer Tools and Services for OCP 4.12 (RHSA-2023:1064)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1064 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

VulnCheck KEV: CVE-2019-1003001

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a...

CVE-2024-31988

CVE-2024-31988 affects XWiki Platform where the realtime editor can lead to arbitrary remote code execution when an admin with programming rights visits a crafted URL or views an image containing that URL (e.g., in a comment). Affected versions are 13.9-rc-1 and earlier, specifically before 14.10...

CVE-2024-31988

XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, b...

CVE-2024-31988 XWiki Platform CSRF remote code execution through the realtime HTML Converter API

XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, b...

CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the Solr-based search in XWiki. This allows any user who can edi...

CVE-2024-31984

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the Solr-based search in XWiki. This allows any user who can edi...

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

Impact When the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, by getting an admin user to either visit a crafted URL or to view an image with this URL that could be in a comment, the...