xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

Bribe Rewards Not Collected In Current Period Will Be Lost Forever

Lines of code Vulnerability details High Bribe Rewards Not Collected In Current Period Will Be Lost Forever Vulnerability Details It was observed that if the bribe rewards are not collected in the current period, they will not be accrued to future epoch, and they will be lost forever...

Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-8P4M-62GP-33J4 Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin

Pipeline GitHub Notify Step Plugin 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid...

GHSA-QHXF-M7JM-JC57 CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin

Pipeline GitHub Notify Step Plugin 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid...

CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-5H29-QQ92-WJ7F Cleartext Transmission of Sensitive Information in Apache MINA

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

OESA-2022-1660 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Insufficient control flow management for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.CVE-2021-33061 A use after free in the Linux...

org.jenkins-ci.plugins:pipeline-githubnotify-step (>=1.0.0, <=1.0.5) potentially affected by CVE-2017-1000091 via org.jenkins-ci.plugins:github-branch-source (1.10.1)

org.jenkins-ci.plugins:github-branch-source MAVEN version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:github-branch-source and may be impacted: - org.jenkins-ci.plugins:pipeline-githubnotify-step =1.0.0, =1.0.5 Source...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2015-0899 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2015-0899 Source advisory: GHSA-CVVX-R33M-V7PQ...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: OSV:GHSA-5GGR-MPGW-3MGX...

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

PT-2022-29976

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.34 Description The issue is related to reference count leaks in the nfs42 proc copy notify function in NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29650

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.20 Description A potential issue exists in the NFSv4.2 implementation, specifically in the nfs42 proc copy notify function, where reference count leaks may occur. The actual impact and attack plausibility o...

PT-2022-30265

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.111 Description The issue is related to reference count leaks in the nfs42 proc copy notify function in NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29307

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.3 Description The issue is related to reference count leaks in the nfs42 proc copy notify function in NFSv4.2. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29121

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.103 Description A memory leak issue was discovered in the int340x driver, specifically in the int3400 notify function. The actual impact and attack plausibility of this issue have not yet been proven...

PT-2022-28999

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.12 Description A memory leak issue was discovered in the int3400 notify function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-29066

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.26 Description A memory leak issue exists in the int3400 notify function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.15.26,...