Ivy

이 저장소는 보관되었습니다 Ivy의 최신 버전을 보거나 이슈를 제출하려면 https://github.com/Tylous/Ivy를 참조하십시오. 추가 정보 이 프레임워크에서 사용된 기술과 이를 방어하기 위한 방어 조치에 대해 더 알아보려면 Article을 참조하십시오. 설명 Ivy는 메모리에서 임의의 VBA매크로 소스 코드를 실행하기 위한 페이로드 생성 프레임워크입니다. Ivy의 로더는 VBA 객체 환경의 프로그래밍 접근을 악용하여 셸코드를 로드, 복호화 및 실행합니다. 이 기술은 진정한 파일리스fileless에 최대한 가깝습니...

Path Traversal

Apache Ivy is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of module coordinates in the PackagerResolver, where the calculated subdirectory path based on coordinates such as organisation, name, or version is concatenated with the buildRoot directory and an...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xhci: Device endpoints are removed from the bandwidth list when the device is freed. Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If the xHCI host is dying or bein...

[SECURITY] Fedora 44 Update: apache-ivy-2.6.0-2.fc44

Apache Ivy is a tool for managing recording, tracking, resolving and reporting project dependencies. It is designed as process agnostic and is not tied to any methodology or structure. while available as a standalone tool, Apache Ivy works particularly well with Apache Ant providing a number of...

[SECURITY] Fedora 43 Update: apache-ivy-2.6.0-2.fc43

Apache Ivy is a tool for managing recording, tracking, resolving and reporting project dependencies. It is designed as process agnostic and is not tied to any methodology or structure. while available as a standalone tool, Apache Ivy works particularly well with Apache Ant providing a number of...

Fedora 44 : apache-ivy (2026-c02768c662)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c02768c662 advisory. IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. IVY-1664 IMPROVEMENT: ivy:makepom will now add override elemen...

Fedora 43 : apache-ivy (2026-d0535bed52)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0535bed52 advisory. IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. IVY-1664 IMPROVEMENT: ivy:makepom will now add override elemen...

CVE-2026-26032

A flaw was found in Apache Ivy's PackagerResolver. An attacker with access to a packager repository can exploit this by injecting specially crafted module coordinates into ivy.xml files. These malicious coordinates, containing directory traversal sequences, allow the attacker to overwrite files...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70448

The Jenkins Ivy Report Plugin (version 1.2 and earlier ) is vulnerable to XML External Entity (XXE) attacks because it fails to configure its XML parser to prevent external entities when processing Ivy report files. This flaw allows attackers who can control workspace contents to force the Jenkin...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

EUVD-2026-53542

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

CVE-2026-70448: Improper Restriction of XML External Entity Reference

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CLSA-2026-1775608270 TuxCare security update for org.apache.ivy:ivy (2 CVEs)

TuxCare rebuilt org.apache.ivy:ivy to address 2 CVEs. Fixed in 2.3.0-tuxcare.1...

SUSE SLES16 Security Update : apache-ivy (SUSE-SU-2026:22858-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22858-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow...

openSUSE 16 Security Update : apache-ivy (openSUSE-SU-2026:21424-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21424-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting...