PT-2020-15486 · Jenkins · Jenkins Perfecto Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Perfecto Plugin versions 1.17 and earlier Description: The issue allows attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller. This is possible because the Perfecto Plugin executes a command on th...

zeitarbeit-job-netzwerk.de Cross Site Scripting vulnerability OBB-1336992

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-13284

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token...

Authorization

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token...

UBUNTU-CVE-2020-13284

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token...

CVE-2020-13284

GitLab CVE-2020-13284 affects GitLab versions prior to 13.1.10, 13.2.8, and 13.3.4, where API authorization could be compromised via an outdated CI job token. The connected sources confirm the affected branches and the specific vulnerable component (CI/job token handling) but do not provide attac...

CVE-2020-13284

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token...

grok:grk_decompress_fuzzer: Heap-use-after-free in grk::SOTMarker::read

Detailed Report: https://oss-fuzz.com/testcase?key=5720229752340480 Project: grok Fuzzing Engine: afl Fuzz Target: grkdecompressfuzzer Job Type: aflasangrok Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x60d000000380 Crash State: grk::SOTMarker::read grk::j2kreadsot...

FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)

Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...

xxl-job Information Disclosure Vulnerability

xxl-job is a distributed task scheduling platform with core design goals of rapid development, simple learning, lightweight, and easy scalability. An information disclosure vulnerability exists in xxl-job 2.2.0, which can be exploited by an attacker to obtain username, model, and password...

xxl-job cross-site scripting vulnerability

xxl-job is a distributed task scheduling platform with core design goals of rapid development, simple learning, lightweight, and easy scalability. xxl-job 2.2.0 suffers from a cross-site scripting vulnerability that can be exploited to inject arbitrary Web script or HTML via the AppName and...

CVE-2020-23811

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java...

CVE-2020-23811

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java...

CVE-2020-23814

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file...

CVE-2020-23814

Multiple cross-site scripting XSS vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 AppName and 2AddressList parameter in JobGroupController.java file...

Information disclosure

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java...

CVE-2020-23814

XXL-JOB v2.2.0 contains stored XSS vulnerabilities (CVE-2020-23814) exploitable via AppName and AddressList in JobGroupController.java. Nuclei templates confirm the issue and specify the impact as arbitrary script injection by an authenticated user, with potential session cookie theft or administ...

CVE-2020-23811

CVE-2020-23811 affects xxl-job 2.2.0, enabling information disclosure of username, model, and password via job/admin/controller/UserController.java. Public details consistently describe the vulnerability as an information disclosure flaw in the UserController, with no explicit exploit vector, imp...

CVE-2020-23811

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java...

PT-2020-15584

Name of the Vulnerable Software and Affected Versions: xxl-job version 2.2.0 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the AppName and AddressList parameters in the...