CVE-2023-3655 Unauthenticated Remote Database Exfiltration

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database system settings, user accounts,.... This vulnerability can be triggered by an HTTP endpoint exposed to the...

CVE-2023-3655

The CVE-2023-3655 entry concerns cashIT! - serving solutions on devices running version 03.A06rks 2023.02.37. Connected PT-2023-25621 details indicate the vulnerability allows leakage of the database (including system settings and user accounts) via an HTTP endpoint exposed to the network. No exp...

CVE-2023-3655 Unauthenticated Remote Database Exfiltration

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database system settings, user accounts,.... This vulnerability can be triggered by an HTTP endpoint exposed to the...

CVE-2023-3656 Unauthenticated Remote Code Execution

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...

CVE-2023-3656: Exposed Dangerous Method or Function

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...

CVE-2023-3655: Exposed Dangerous Method or Function

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database system settings, user accounts,.... This vulnerability can be triggered by an HTTP endpoint exposed to the...

PT-2023-25619

Name of the Vulnerable Software and Affected Versions cashIT! - serving solutions versions 03.A06rks 2023.02.37 and earlier Description The issue is related to an origin bypass via the host header in an HTTP request. This can be triggered by an HTTP endpoint exposed to the network. Recommendation...

PT-2023-25623 · Pos/ Dienstleistung · Cashit!

Name of the Vulnerable Software and Affected Versions: cashIT! - serving solutions versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 Description: The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint...

Jenkins Build Failure Analyzer Plugin missing permission check

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. Additionally, th...

Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. Additionally, th...

GHSA-55Q6-R3HM-7FF4 Jenkins Build Failure Analyzer Plugin missing permission check

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. Additionally, th...

GHSA-2WWH-QGH8-W9XW Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST requests for an HTTP endpoint, resulting in cross-site request forgery CSRF vulnerabilities. This vulnerability allows attackers to delete Failure Causes. Build Failure Analyzer Plugin 2.4.2 requires POST requests for t...

PT-2023-28846

Name of the Vulnerable Software and Affected Versions Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password...

CVE-2023-41943

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

Design/Logic Flaw

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

CVE-2023-41943

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

CVE-2023-41943

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

PT-2023-28181 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. This can be exploited...

Cross-site Request Forgery

blueocean is vulnerable to Cross-site Request Forgery. The vulnerability is due to a lack of requiring POST requests for an HTTP endpoint in GithubScm.java, which allows an attacker to view github credentials...

Cross-site Request Forgery (CSRF)

org.jenkins-ci.plugins, favorite-view is vulnerable to Cross-Site Request Forgery. The vulnerability exists due to the lack of validation in the HTTP endpoint which allows an attackers to add or remove views from another user's favorite views tab bar...