CVE-2023-41943

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

Jenkins Plugin AWS CodeCommit Trigger Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin AWS CodeCommit Trigger Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. Jenkins Plugin AWS...

PT-2023-28182

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description The issue is related to an HTML injection vulnerability. It occurs when the queue name parameter passed to a form validation URL is not escaped, resulting in the...

CSRF vulnerability and missing permission check in aws-codecommit-trigger

aws-codecommit-trigger 3.0.12 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to clear the SQS queue. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery CSRF vulnerability. A...

HTML injection vulnerability in aws-codecommit-trigger

aws-codecommit-trigger 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message. This results in an HTML injection vulnerability. NOTE: Since Jenkins 2.275 and LTS 2.263.2, a security hardening for form validation responses...

CVE-2023-41944: Improper Neutralization of Input During Web Page Generation

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

PT-2023-28180 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to clear the SQS queue. Recommendations: For Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12...

PT-2023-28181 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. This can be exploited...

CVE-2023-41943: Missing Authorization

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue...

CVE-2023-41942: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue...

PT-2023-5190

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free vulnerability in the Linux kernel's net/sched: sch qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qf...

CVE-2023-20844

In imgsyscmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354058; Issue ID: ALPS07340121...

CVE-2023-20849

In imgsyscmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340350...

MediaTek Chip Buffer Error Vulnerability

MediaTek chips are a variety of MediaTek chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which stems from an incorrect state check in cmdq, which may result in an out-of-bounds read...

MediaTek Chip Resource Management Error Vulnerability

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips that stems from a lack of valid range checking in imgsyscmdq, which could be exploited after release...

Noticing exceptionally high current client connections for a single server within the service group

Go check Load Balance Virtual Server's Statistics data, under theBound Service Group Members Summary tab,you've observed that the Current client connection count of specific server is significantly higher than the other servers within the same service group. In NS shell mode, "nsconmsg ConLb=2...

MediaTek Chip Buffer Error Vulnerability

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which stems from a lack of valid range checking in imgsyscmdq, which may result in out-of-bounds reads...

PT-2023-17666 · Mediatek +3 · Mt2713 +5

Name of the Vulnerable Software and Affected Versions: No specific software name and version are mentioned in the provided descriptions. Description: In imgsys cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege wit...

PT-2023-17672 · Unknown · Imgsys Cmdq

Name of the Vulnerable Software and Affected Versions: imgsys cmdq affected versions not specified Description: In imgsys cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed...