PT-2020-15350 · Jenkins · Jenkins Cobertura Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cobertura Plugin versions 1.15 and earlier Description: The issue allows attackers who can control the coverage report file contents to overwrite any file on the Jenkins master file system. This is due to an arbitrary file write...

CloudBees Jenkins RadarGun plugin code issue vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A code issue vulnerability...

Exploit for CVE-2019-1003000

PoC exploit for CVE-2019-1003000, CVE-2019-1003001, and CVE-2019-1003002, which are related to Script Security, Pipeline: Groovy, and Pipeline: Declarative plugins in Jenkins. The exploit allows users with Overall/Read permission and Job/Configure and optional Job/Build to bypass the sandbox...

PT-2019-14722 · Jenkins · Jenkins Team Concert Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Concert Plugin versions 1.3.0 and earlier Description: A missing permission check in form-related methods allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Recommendations: For...

Flaw in Elementor and Beaver Addons Let Anyone Hack WordPress Sites

Attention WordPress users! Your website could easily get hacked if you are using "Ultimate Addons for Beaver Builder," or "Ultimate Addons for Elementor" and haven't recently updated them to the latest available versions. Security researchers have discovered a critical yet easy-to-exploit...

WordPress safe-svg denial of service vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. safe-svg is an SVG Scalable Vector Graphics upload plugin used in it. A denial of service vulnerability exists in WordPress safe-svg...

WordPress dynamic-widgets plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. dynamic-widgets is a dynamic widget management plugin used in it. A cross-site request forgery vulnerability exists in WordPress...

WordPress display-widgets plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. display-widgets is a widget display plugin used in it. A cross-site scripting vulnerability exists in WordPress display-widgets...

WordPress wp-live-chat-support plugin cross-site scripting vulnerability (CNVD-2019-27637)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-live-chat-support plugin is a live chat plugin used in it. A cross-site scripting vulnerability exists in WordPress...

com.diffplug.gradle.spotless:com.diffplug.gradle.spotless.gradle.plugin (>=3.0.0 <=3.19.0), gradle.plugin.io.beekeeper.gradle:beekeeper-formatter-plugin (=0.1) +18 more potentially affected by CVE-2019-9843 via com.diffplug.spotless:spotless-plugin-gradle (>=3.0.0 <=3.1.0)

com.diffplug.spotless:spotless-plugin-gradle MAVEN version =3.0.0, =3.0.0, =0.2, =0.1, =0.2, =0.2, =0.12.0, =0.12.0, =0.1.7, =1.0.0, =1.0.0, =0.1.7, =1.0.2, =0.1.7, =1.1.0 and more Source cves: CVE-2019-9843 Source advisory: OSV:GHSA-7V35-QWWJ-P98Ghttps://vulners...

WordPress HTML5 Maps Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.HTML5 Maps plugin is an interactive maps plugin used in it. Cross-site request forgery vulnerability exists in WordPress HTML5 Maps...

CloudBees Script Security Plugin Sandbox Bypass Vulnerability

CloudBees Script Security Plugin is the U.S. CloudBees company's Jenkins Java-based development of continuous integration tools in a plug-in for detecting script security . A sandbox bypass vulnerability exists in the groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java...

WordPress iThemes Security Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on PHP and MySQL servers. iThemes Security plugin is a security plugin used in it. A security vulnerability exists in WordPress iThemes Security...

WordPress Soundy Audio Playlist Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.Soundy Audio Playlist plugin is an audio playlist component used in ... A cross-site scripting vulnerability exists in WordPress Soun...

WordPress Store Locator Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Store Locator plugin is one of the store locator plugin . A SQL injection vulnerability exists in WordPress Sto...

Jenkins OWASP Dependency-Check plugin HTML injection vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools , it is mainly used to monitor the continuous software version release/testing projects and some timed tasks . OWASP Dependency-Check Plugin is one of the dependency check plugin . Dependency-Check...

[flunym0us] Vulnerability Scanner for Wordpress and Moodle

Flunym0us is a Vulnerability Scanner for Wordpress and Moodle designed by Flu Project Team. Flunym0us has been developed in Python. Flunym0us performs dictionary attacks against Web sites. By default, Flunym0us includes a dictionary for Wordpress and other for Moodle. Operation Flunym0us requires...

plugin: improper Implementation of shellescape() (arbitrary code execution)

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" exclamation point shell metacharacter in 1 the filename of a tar archive and possibly 2 the filename of the first file in a tar archive, which is not properly...