5532 matches found
CVE-2022-24445
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
VMconf 22: Blindspots in the Knowledge Bases of Vulnerability Scanners
Hello everyone! This video was recorded for the VMconf22 Vulnerability Management conference. I want to talk about the blind spots in the knowledge bases of Vulnerability Scanners and Vulnerability Management products. This report was presented in Russian at Tenable Security Day 2022. The video i...
Jenkins Conjur Secrets Plugin授权问题漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Conjur Secrets Plugin 1.0.11 and earlier versions are vulnerable to an authorization issue that stems from not...
Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs
Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
GHSA-2PJ6-5HQC-W5X9 CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials
WAMP Plugin 1.2.6 and earlier does not perform a permission check in a method implementing form validation.\ This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...
PT-2022-7488
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a crash due to out of bounds access into reg2btf ids in the Linux kernel's bpf component. This occurred after a commit added kfunc support and defined reg2btf ids...
CVE-2022-25200
A cross-site request forgery CSRF vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CVE-2022-25201
Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
Design/Logic Flaw
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CVE-2022-25193
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CVE-2022-25190
A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
GHSA-HF6F-JQ25-8GQ9 Gitea Remote Code Execution (RCE)
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron...
PT-2022-17140 · Jenkins · Jenkins Checkmarx Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Checkmarx Plugin versions 2022.1.2 and earlier Description: The issue is related to missing permission checks in the Jenkins Checkmarx Plugin, allowing attackers with Overall/Read permission to connect to an attacker-specified webserv...
CVE-2022-23337
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in articlecoonepagerule.php via the ids parameter...
CVE-2022-23337
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in articlecoonepagerule.php via the ids parameter...
Sql injection
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in articlecoonepagerule.php via the ids parameter...
CVE-2022-23337
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in articlecoonepagerule.php via the ids parameter...
EUVD-2022-28417
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in articlecoonepagerule.php via the ids parameter...
CVE-2022-23337
DedeCMS v5.7.87 contains a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. Connected sources (NVD, Red Hat, CNNVD, etc.) describe this as a SQLi affecting the page logic and parameter ids, with CVSS v3.1 base score 9.8 (CRITICAL) and CVSSv2 7.5 (HIGH), indicating ...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1094)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...