jenkins-script-security-plugin: handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts...

jenkins-script-security-plugin: handling of property names in property expressions on the left-hand side of assignment expression leads to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts...

CVE-2012-2148

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies...

CVE-2012-2148

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies...

Security feature bypass

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies...

CVE-2012-2148

Technical details (affected product/version, root cause, impact, or mitigations) are not publicly available in the provided documents. Monitor for updates to official advisories and vendor notices.

CVE-2012-2148

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies...

PT-2019-6757

Name of the Vulnerable Software and Affected Versions JBoxx AS version 7.1.1 Description An issue exists in the property replacements feature in any descriptor, where JBoxx AS ignores Java security policies. Recommendations For JBoxx AS version 7.1.1, at the moment, there is no information about ...

CVE-2012-2148: Improper Privilege Management

An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies...

EulerOS Virtualization for ARM 64 3.0.3.0 : systemd (EulerOS-SA-2019-2319)

According to the versions of the systemd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be...

A week in security (November 25 – December 1)

Last week on Malwarebytes Labs, we discussed why the notion of "data as property" may potentially hurt more than help, homed in on sextortion scammers getting more creative, and explored the possible security risks Americans might face if the US changed to universal healthcare coverage. Other...

Carlo Gavazzi SmartHouse Webapp 6.5.33 CSRF/XSS Vulnerabilities

Summary Carlo Gavazzi is an international company that develops, manufactures and sells electrical automation components. Our products are used in industrial automation and real estate automation. Smart-house is based on a system that we have developed and produced since 1986, mainly for...

Carlo Gavazzi SmartHouse 6.5.33 XSS / Cross Site Request Forgery

Carlo Gavazzi SmartHouse Webapp 6.5.33 CSRF/XSS Vulnerabilities Vendor: Carlo Gavazzi Automation S.p.A Product web page: http://www.gavazzi-automation.com | http://www.smarthouse.nu Affected version: Web-app: 6.5.33.17072501 Web-app: 6.5.32.17062101 Web-app: 6.2.3.16102701 Web-app: 5.5.3.16042110...

Internal Property Tampering

Overview schema-inspector is a JSON API sanitisation and validation module. Affected versions of this package are vulnerable to Internal Property Tampering. A maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector. Remediation Upgrade...

‘Data as property’ promises fix for privacy problems, but could deepen inequality

In mid-November, Democratic presidential hopeful Andrew Yang unveiled a four-prong policy approach to solving some of today’s thornier tech issues, such as widespread misinformation, technology dependence, and data privacy. Americans, Yang proposed, should receive certain, guaranteed protections...

iTerm2 Information Disclosure Vulnerability (CNVD-2020-41520)

iTerm2 is a GPL-licensed terminal emulator for macOS. An information disclosure vulnerability exists in iTerm2 3.3.6 and earlier versions, which can be exploited by a remote attacker to obtain sensitive information by searching for the NoSyncSearchHistory string in a .plist file in a public Git...

CVE-2019-19022

iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Gi...

property-d.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1016885 Security Researcher WhiteDevil Helped patch 67 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting property-d.com website and...

CVE-2019-15391

The Asus ZenFone 4 Selfie Android device with a build fingerprint of asus/WWPhone/ASUSX00LD1:8.1.0/OPM1.171019.011/15.0400.1809.405-0:user/release-keys contains a pre-installed app with a package name of com.log.logservice app versionCode=1, versionName=1 that allows any app co-located on the...

CVE-2019-15392

The Asus ZenFone 4 Selfie Android device with a build fingerprint of Android/sdm66064/sdm66064:8.1.0/OPM1/14.2016.1802.247-20180419:user/release-keys contains a pre-installed app with a package name of com.log.logservice app versionCode=1, versionName=1 that allows any app co-located on the devic...