CVE-2022-28158

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2022-28158

CVE-2022-28158 affects Jenkins Pipeline: Phoenix AutoTest Plugin (1.3 and earlier). The vulnerability stems from a missing permission check across multiple HTTP endpoints, enabling an attacker with Overall/Read permissions to enumerate credentials IDs stored in Jenkins. The provided connected doc...

CVE-2022-28157

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...

CVE-2022-28157

CVE-2022-28157 affects Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier. The vulnerability allows an attacker with Item/Configure permission to cause the Jenkins controller to upload arbitrary files to an attacker‑supplied FTP server, via FTP. Multiple connected sources corroborate that ...

CVE-2022-28156

CVE-2022-28156 affects Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier. The vulnerability allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace. The connected sources also describe a related path-traver...

CVE-2022-28156

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...

CVE-2022-28155

CVE-2022-28155 concerns the Jenkins Pipeline: Phoenix AutoTest Plugin (versions 1.3 and earlier). The vulnerability arises because the plugin’s XML parser is not configured to prevent XML external entity (XXE) attacks. Attackers able to supply crafted XML inputs to build steps such as readXml/wri...

Jenkins Pipeline 代码问题漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to XML external entity injection, which can be exploited by remote attackers to...

PT-2022-18854 · Jenkins · Jenkins Pipeline: Phoenix Autotest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier Description: The issue is related to the Phoenix AutoTest Plugin not configuring its XML parser to prevent XML external entity XXE attacks. This allows attackers who can contr...

Jenkins Pipeline Phoenix AutoTest Plugin 路径遍历漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.The Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier versions are vulnerable to a path traversal vulnerability that could be exploited by an attacker with...

PT-2022-18856 · Jenkins · Jenkins Pipeline: Phoenix Autotest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier Description: The issue allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...

Jenkins Pipeline Phoenix AutoTest Plugin 访问控制错误漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins.An access control error vulnerability exists in Jenkins Pipeline Phoenix AutoTest Plugin 1.3 and earlier, which stems from the plugin not performing permission check...

PT-2022-18855 · Jenkins · Jenkins Pipeline: Phoenix Autotest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier Description: The issue allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...

Malware Posing as Russia DDoS Tool Bites Pro-Ukraine Hackers

Looking to cyber-hassle Russia, Ukrainian sympathizers? Be careful — malware is making the rounds, disguised as a pro-Ukraine cyber-tool that will turn around and bite you instead, researchers are warning. In a Wednesday threat advisory, Cisco Talos described a campaign it’s observed in which a...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

Design/Logic Flaw

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

CVE-2022-22509

CVE-2022-22509 affects Phoenix Contact FL SWITCH Series 2xxx (version 3.00). The issue is an incorrect privilege assignment that lets a low-privilege user gain full access to the device configuration, exposing confidentiality, integrity, and availability (all rated high) per CVSS metrics. No expl...

CVE-2022-22509 PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

Phoenix Contact FL SWITCH 安全漏洞

The Phoenix Contact FL SWITCH is an industrial grade Ethernet switch from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact FL SWITCH Series that originates from allowing a user with low privileges to enable full access to the device configuration...