PT-2022-22354 · Jenkins · Jenkins Rocketchat Notifier Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins RocketChat Notifier Plugin versions 1.5.2 and earlier Description: The issue concerns the storage of sensitive information in the global configuration file on the Jenkins controller. Specifically, the login password and webhook token...

GSD-2022-1003541 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier

coresight: cpu-debug: Replace mutex with mutextrylock on panic notifier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

GSD-2022-1003287 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier

coresight: cpu-debug: Replace mutex with mutextrylock on panic notifier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002998 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier

coresight: cpu-debug: Replace mutex with mutextrylock on panic notifier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.15 by commit...

GSD-2022-1002658 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier

coresight: cpu-debug: Replace mutex with mutextrylock on panic notifier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

MAL-2022-526 Malicious code in @primeo/notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a51b35e86abf2d2fc11c572f2372c900eeb33cd05bed616fa0a3071979193bde Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6159 Malicious code in slack-notifier-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2022:1939-1 Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP4)

This update for the Linux Kernel 4.12.14-9588 fixes several issues. The following security issues were fixed: - CVE-2022-1048: Fixed a race Condition in sndpcmhwfree leading to use-after-free due to the AB/BA lock with buffermutex and mmaplock bsc1197597. - CVE-2022-30594: Fixed restriction bypas...

PT-2022-3650 · Red Hat · Red Hat Advanced Cluster Security For Kubernetes

Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description: A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes, related to insufficient protection of service data in the GraphQL API. Thi...

Red Hat stackrox 安全漏洞

Red Hat stackrox is a full lifecycle Kubernetes security solution from Red Hat. It allows you to detect, manage, and mitigate security risks, such as misconfigurations, and vulnerabilities CVEs. A security vulnerability exists in Red Hat stackrox that stems from improper stackrox cleanup. An...

Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the...

GHSA-826H-FXFF-HPQF Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials

Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is...

Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials

Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +2157 more potentially affected by CVE-2010-3700 via org.acegisecurity:acegi-security (>=1.0.0 <=1.0.7)

org.acegisecurity:acegi-security MAVEN version =1.0.0, =1.1, =0.0.1, =1.0, =1.0, =0.0.1, =0.1.1, =0.1.0, =1.0, =1.17.3 and more Source cves: CVE-2010-3700 Source advisory: OSV:GHSA-3295-H9QX-R82X...

org.jenkins-ci.plugins:global-slack-notifier (>=1.0 <=1.3) potentially affected by CVE-2019-1003044 via org.jenkins-ci.plugins:slack (=2.2)

org.jenkins-ci.plugins:slack MAVEN version =2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:slack and may be impacted: - org.jenkins-ci.plugins:global-slack-notifier =1.0, =1.3 Source cves: CVE-2019-1003044 Source advisory:...

Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text

Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.snsnotify.AmazonSNSNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-84P4-7MXC-7PHJ Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text

Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.snsnotify.AmazonSNSNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

org.jenkins-ci.plugins:global-slack-notifier (>=1.0 <=1.3) potentially affected by CVE-2019-1003043 via org.jenkins-ci.plugins:slack (=2.2)

org.jenkins-ci.plugins:slack MAVEN version =2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:slack and may be impacted: - org.jenkins-ci.plugins:global-slack-notifier =1.0, =1.3 Source cves: CVE-2019-1003043 Source advisory:...

com.buildcoin.plugins.jenkins:buildcoin-plugin (>=1.0 <=1.4), com.coravy.hudson.plugins.github:github (>=1.1 <=1.8) +99 more potentially affected by CVE-2012-0785 via org.jenkins-ci.main:jenkins-core (>=1.425 <=1.446)

org.jenkins-ci.main:jenkins-core MAVEN version =1.425, =1.0, =1.1, =0.3.2, =1.1, =1.0, =0.1, =1.1, =1.1, =0.2.5, =1.425, =1.425, =1.425, =1.425, =1.446 and more Source cves: CVE-2012-0785 Source advisory: OSV:GHSA-PCHP-C5W8-47GC...