Design/Logic Flaw

In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Mos...

CVE-2020-15526

In Redgate SQL Monitor 7.1.4 through 10.1.6 inclusive, the scope for disabling some TLS security certificate checks can extend beyond that defined by various options on the Configuration Notifications pages to disable certificate checking for alert notifications. These TLS security checks are als...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4077 via electron (>=7.0.0, <=7.2.3)

electron NPM version =7.0.0, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4077 Source advisory: OSV:GHSA-H9JC-284H-533G...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4076 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4076 Source advisory: OSV:GHSA-M93V-9QJC-3G79...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-15096 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

@donmahallem/trapeze-client-electron (>=1.5.3, <=1.6.0), @evgenious/electron-prebuilt-compile (6.0.3) +13 more potentially affected by CVE-2020-15096 via electron (>=6.0.0, <=6.1.10)

electron NPM version =6.0.0, =1.5.3, =6.0.0-beta.1, =6.0.0-beta.1, =0.1.0, =0.5.17, =1.0.2, =3.0.2, =1.1.6, =3.0.3, =0.0.1, =0.0.38 Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

CloudBees Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor continuous software version release/testing projects and some timed tasks.ElasticBox Jenkins Kubernetes CI/CD Plugin is used in...

CloudBees Jenkins Sonargraph Integration Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Sonargraph Integration Plugin is used in one ...

CVE-2020-2201

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2201

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2201

The CVE-2020-2201 entry concerns Jenkins Sonargraph Integration Plugin versions 3.0.0 and earlier, where the Log file field form validation does not escape the file path, causing a stored cross-site scripting (XSS) vulnerability. Affected component: Sonargraph Integration Plugin; root cause: lack...

CVE-2020-2201

Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability...

Stored XSS vulnerability in sonargraph-integration

sonargraph-integration 3.0.0 and earlier does not escape the file path for the Log file field form validation. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Job/Configure permission. sonargraph-integration 3.0.1 escapes the affected part of th...

Successful DevSecOps begins with a cultural shift

A successful DevSecOps approach fosters cohesive collaboration between Development, Security, and Operations teams for the cultivation of outcomes that improve security while also maintaining the goals of DevOps. Within DevSecOps, security is an additional foundational component in the process...

Risk Decisions in an Imperfect World

Risk decisions are the foundation of information security. Sadly, they are also one of the most often misunderstood parts of information security. This is bad enough on its own but can sink any effort at education as an organization moves towards a DevOps philosophy. To properly evaluate the risk...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11 (CVE-2019-2949)

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Integration Bus & IBM App Connect Enterprise v11. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to t...

OPENSUSE-SU-2020:0902-1 Security update for chromium

This update for chromium fixes the following issues: Update to 83.0.4103.116 boo1173251: CVE-2020-6509: Use after free in extensions - Add patch to work with new ffmpeg bsc1173292 - Add multimedia fix for disabled location and also try one additional patch from Debian on the same issue boo1173107...

openSUSE: Security Advisory for chromium (openSUSE-SU-2020:0887-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for chromium (openSUSE-SU-2020:0893-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...