Missing validation causes denial of service via `GetSessionTensor`

Impact The implementation of tf.rawops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf handle = tf.constant"", shape=0, dtype=tf.string...

GHSA-CG4H-CFJP-H3X2 Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin

Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin

Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-5311 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-5311 Source advisory: OSV:GHSA-R7RM-8J6H-R933...

GHSA-JXG7-CGHF-MGGX Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation

VMware Lab Manager Slaves Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. As of publication of this advisory, there is no fix...

Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation

VMware Lab Manager Slaves Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. As of publication of this advisory, there is no fix...

Nokogiri Improperly Handles Unexpected Data Type

Summary Nokogiri = 1.13.6. JRuby users are not affected. Workarounds To avoid this vulnerability in affected applications, ensure the untrusted input is a String by calling tos or equivalent. Credit This vulnerability was responsibly reported by @agustingianni and the Github Security Lab...

GHSA-XH29-R2W5-WX8M Nokogiri Improperly Handles Unexpected Data Type

Summary Nokogiri = 1.13.6. JRuby users are not affected. Workarounds To avoid this vulnerability in affected applications, ensure the untrusted input is a String by calling tos or equivalent. Credit This vulnerability was responsibly reported by @agustingianni and the Github Security Lab...

GitHub Security Lab: [Java]: Flow sources and steps for JMS and RabbitMQ

This bug was reported directly to GitHub Security Lab...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388-rs Scanner and Interactive shell for CVE-2022-13...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2014-3007 via pillow (>=2.0.0, <=2.4.0)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - planadversity 1.0.2 Source cves: CVE-2014-3007 Source advisory: OSV:GHSA-8M9X-PXWQ-J236...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2014-3007 via pillow (>=2.0.0, <=2.4.0)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - planadversity 1.0.2 Source cves: CVE-2014-3007 Source advisory: GHSA-8M9X-PXWQ-J236...

GitHub Security Lab: [python]: Zip Slip Vulnerability

This bug was reported directly to GitHub Security Lab...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2014-3598 via pillow (>=2.0.0, <=2.4.0)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - planadversity 1.0.2 Source cves: CVE-2014-3598 Source advisory: OSV:GHSA-J6F7-G425-4GMX...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2014-3598 via pillow (>=2.0.0, <=2.4.0)

pillow PYPI version =2.0.0, =1.0.0, =1.0.2 - planadversity 1.0.2 Source cves: CVE-2014-3598 Source advisory: GHSA-J6F7-G425-4GMX...

Jenkins VMware Lab Manager Slaves Plugin vulnerable CSRF vulnerability

A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

GHSA-6J5J-W6V4-RWQR Jenkins VMware Lab Manager Slaves Plugin vulnerable CSRF vulnerability

A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

Missing permission check in Jenkins VMware Lab Manager Slaves Plugin

A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

GHSA-56FF-M6PV-8594 Missing permission check in Jenkins VMware Lab Manager Slaves Plugin

A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

com.agilejava.docbkx:docbkx-fop-support (>=2.0.9, <=2.0.11), com.agilejava.docbkx:docbkx-maven-plugin (>=2.0.9, <=2.0.11) +39 more potentially affected by CVE-2017-5661 via org.apache.xmlgraphics:fop (0.95)

org.apache.xmlgraphics:fop MAVEN version 0.95 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:fop and may be impacted: - com.agilejava.docbkx:docbkx-fop-support =2.0.9, =2.0.9, =5.3.0, =1.8.1-interpolation-hotfix-rc4, =1.5.0.1,...