CVE-2019-16556

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

jenkins-script-security: Sandbox bypass vulnerability in Script Security Plugin

A flaw was found in the Jenkins Script Security plugin. Sandbox protection could be circumvented through default parameter expressions in constructors. This allowed attackers, able to specify and run sandboxed scripts, to execute arbitrary code in the context of the Jenkins master JVM. The highes...

PT-2019-14727 · Jenkins · Jenkins Weibo Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Weibo Plugin versions 1.0.1 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file on the Jenkins master. This can be viewed by users with access to the master file system...

PT-2019-14712 · Redgate +1 · Jenkins Redgate Sql Change Automation Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Redgate SQL Change Automation Plugin versions 2.0.3 and earlier Description: The issue allows credentials to be stored unencrypted in job config.xml files on the Jenkins master. Users with Extended Read permission or access to the...

PT-2019-14716 · Jenkins · Jenkins Websphere Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins WebSphere Deployer Plugin version 1.6.1 and earlier Description: The issue allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. Recommendations: For Jenkins...

jenkins-script-security: Sandbox bypass vulnerability in Script Security Plugin

A flaw was found in the Jenkins Script Security plugin. Sandbox protection could be circumvented through default parameter expressions in constructors. This allowed attackers, able to specify and run sandboxed scripts, to execute arbitrary code in the context of the Jenkins master JVM. The highes...

WordPress quiz-master-next cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. quiz-master-next is a survey plugin used in it. A cross-site scripting vulnerability exists in WordPress quiz-master-next versions pri...

WordPress Quiz And Survey Master plugin <= 6.3.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by strongPiggg in WordPress Quiz And Survey Master plugin versions = 6.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at least 6.3.5...

CVE-2019-17599

The quiz-master-next aka Quiz And Survey Master plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter and/or the quizid parameter. The component is:...

Cross site scripting

The quiz-master-next aka Quiz And Survey Master plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter and/or the quizid parameter. The component is:...

CVE-2019-17599

The quiz-master-next aka Quiz And Survey Master plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter and/or the quizid parameter. The component is:...

CVE-2019-2231

In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID...

CVE-2019-2231

In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID...

Input validation

In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID...

CVE-2019-2231

In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID...

CVE-2019-2231

CVE-2019-2231 affects the Android blob handling in Blob::Blob (blob.cpp), where improper input validation can lead to an unencrypted master key and local information disclosure. The issue requires local access with system privileges to exploit, with no user interaction needed. Public sources conf...

Arbitrary Code Execution

Overview safer-eval is a safer approach for eval in node and browser. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError: Maximum call stack size exceeded. PoC by Jonathan Leitschuh const theFunction = function const f = Buffer.prototype.write...

Iran Targets Mideast Oil with ZeroCleare Wiper Malware

A freshly-discovered wiper malware dubbed “ZeroCleare” has been deployed to target the energy and industrial sectors in the Middle East. According to IBM’s X-Force Incident Response and Intelligence Services IRIS, ZeroCleare so-named because of the program database pathname of its binary file was...

one heap buffer overflow in FilePOSIX::read in File.cpp

one heap buffer overflow in FilePOSIX::read in File.cpp in maste...

PYSEC-2019-22

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with...