PT-2023-31638

Name of the Vulnerable Software and Affected Versions Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description The issue is related to missing permission checks in the Jenkins Nexus Platform Plugin, allowing attackers with Overall/Read permission to connect to an attacker-specifie...

PT-2023-31635 · Jenkins · Jenkins Nexus Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML. The plugin does not...

PT-2023-31636 · Jenkins · Jenkins Nexus Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier Description: The issue is related to missing permission checks in the Jenkins Nexus Platform Plugin, allowing attackers with Overall/Read permission to send an HTTP request to an...

CSRF vulnerability and missing permission checks in Nexus Platform allow XXE

Nexus Platform 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not configure its X...

CSRF vulnerability and missing permission checks in Nexus Platform allow capturing credentials

Nexus Platform 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing...

Jenkins Nexus Platform Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Nexus Platform Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-50767: Missing Authorization

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML...

CVE-2023-50769: Missing Authorization

Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2023-50768: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Cisco Fabric Services Unauthorized Access

The vulnerability of the Cisco Fabric Services component for NX-OS and Cisco FXOS operating systems in Cisco devices is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information o...

nexus-uploader (1.0.14), uranium (>=0.2.38, <=1.1.0) potentially affected by CVE-2023-5752 via pip (8.1.1)

pip PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - nexus-uploader 1.0.14 - uranium =0.2.38, =1.1.0 Source cves: CVE-2023-5752 Source advisory: OSV:PYSEC-2023-228...

Jenkins Maven Artifact ChoiceListProvider Nexus Unprotected Access

The vulnerability of the Jenkins Maven Artifact ChoiceListProvider plugin Nexus is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

New Report Uncovers 3 Distinct Clusters of China-Nexus Attacks on Southeast Asian Government

An unnamed Southeast Asian government has been targeted by multiple China-nexus threat actors as part of espionage campaigns targeting the region over extended periods of time. "While this activity occurred around the same time and in some instances even simultaneously on the same victims'...

Cisco Nexus 3000 and 9000 Series Switches SFTP Server File Access (CVE-2023-20115)

A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying operating system of an affected device. This vulnerability is d...

Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol Denial of Service (CVE-2023-20169)

A vulnerability in the Intermediate System-to-Intermediate System IS- IS protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to...

Cisco NX-OS TACACS RADIUS DoS

The vulnerability of the TACACS and RADIUS protocols for operating systems of Cisco NX-OS routers such as MDS 9000, Nexus 1000, Nexus 1000V, Nexus 3000, Nexus 5500, Nexus 5600, Nexus 6000, Nexus 7000, and Nexus 9000 exists due to insufficient validation of input data. Exploiting this vulnerabilit...

Why is .US Being Used to Phish So Many of Us?

Domain names ending in ".US" -- the top-level domain for the United States -- are among the most prevalent in phishing scams, new research shows. This is noteworthy because .US is overseen by the U.S. government, which is frequently the target of phishing domains ending in .US. Also, .US domains...

Cisco NX-OS File Upload

The vulnerability of the file transfer protocol implementation of the Cisco NX-OS operating system for Cisco Nexus series 3000 and 9000 switches is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to upload or re-write any files as desired...

Cisco NX-OS IS-IS Reboot

The vulnerability of the IS-IS routing protocol implementation in the Cisco NX-OS operating system for Cisco Nexus 3000 and 9000 switches is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to perform a reboot of the device by sending specially...