GHSA-X6JX-CXG3-MGGH Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...

Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...

Jenkins Groovy Plugin sandbox bypass vulnerability

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...

GHSA-6Q78-6XVR-26FG Jenkins Groovy Plugin sandbox bypass vulnerability

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...

am.ik.home:uaa-server (>=1.0.0 <=1.9.0), br.com.intelipost:sdk-java (>=0.0.1 <=0.0.8) +89 more potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (>=1.0.0.RELEASE <=2.6.8.RELEASE)

org.springframework.data:spring-data-rest-core MAVEN version =1.0.0.RELEASE, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =2.3.0-RELEASE, =0.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.1-SNAPSHOTS - com.github.zengfr.project:com.github.zengfr.project.common =0.0.1 - com.github.zengfr.project:com.github.zengfr.project.p...

Remote code execution in PATCH requests in Spring Data REST

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 can use specially crafted JSON data to run arbitrary Java code...

com.github.paulcwarren:content-rest-spring-boot-starter (>=0.5.0 <=0.6.0), com.github.paulcwarren:spring-content-rest (>=0.5.0 <=0.6.0) +8 more potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (>=3.0.0.RELEASE <=3.0.14.RELEASE)

org.springframework.data:spring-data-rest-core MAVEN version =3.0.0.RELEASE, =0.5.0, =0.5.0, =0.5.0, =0.0.1-RELEASE, =1.0.7, =2.0.5.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.14.RELEASE Source cves: CVE-2017-8046 Source advisory: OSV:GHSA-9QF9-28H9-HQCJ...

GHSA-9QF9-28H9-HQCJ Remote code execution in PATCH requests in Spring Data REST

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 can use specially crafted JSON data to run arbitrary Java code...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0 <=1.1.0), ai.platon.pulsar:pulsar-agentic (>=4.5.0 <=4.6.0) +5848 more potentially affected by CVE-2013-4002 via xerces:xercesImpl (>=2.10.0 <=2.11.0)

xerces:xercesImpl MAVEN version =2.10.0, =1.0.0, =4.5.0, =4.7.11, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =0.2, =5.0.9, =5.1.3 and more Source cves: CVE-2013-4002 Source advisory: OSV:GHSA-7J4H-8WPF-RQFH...

ManageEngine Password Manager Pro REST API Restriction Bypass (CVE-2022-29081)

Binary data manageenginepmpcve-2022-29081.nbin...

F5 BIG-IP iControl REST vulnerability

Added: 05/13/2022 CVE: CVE-2022-1388 Background F5 BIG-IP is a suite of network security products. Problem An authentication bypass vulnerability in the iControl REST service allows remote attackers to execute arbitrary commands. Resolution Upgrade to one of the fixed versions referenced in...

F5 BIG-IP iControl REST vulnerability

Added: 05/13/2022 CVE: CVE-2022-1388 Background F5 BIG-IP is a suite of network security products. Problem An authentication bypass vulnerability in the iControl REST service allows remote attackers to execute arbitrary commands. Resolution Upgrade to one of the fixed versions referenced in...

F5 BIG-IP iControl RCE via REST Authentication Bypass

This module exploits an authentication bypass vulnerability in the F5 BIG-IP iControl REST service to gain access to the admin account, which is capable of executing commands through the /mgmt/tm/util/bash endpoint. Successful exploitation results in remote code execution as the root user. Module...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 F5 BIG-IP iControl REST vulnerability RCE exploi...

Security Bulletin: IBM MQ WebConsole and REST API are affected by CVE-2021-39031.

Summary An issue was identified within the IBM WebSphere Application Server Liberty profile that IBM MQ uses to provide web console and REST API functionality. Vulnerability Details CVEID:CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow ...

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

The plugin does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users PoC curl 'https://example.com/index.php?restroute=/xs-donate-form/payment-redirect/3' \ --data '"id": "SELECT 1 FROM...

Hackers Actively Exploit F5 BIG-IP Bug

Threat actors have started exploiting a critical bug in the application service provider F5’s BIG-IP modules after a working exploit of the vulnerability was publicly made available. The critical vulnerability, tracked as CVE-2020-1388, allows unauthenticated attackers to launch “arbitrary system...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

PoC exploit for CVE-2022-1388, a vulnerability in the BIG-IP iCo...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

Nuclei Template Exploit F5 BIG-IP iControl REST Auth Bypass RC...

WordPress Order Listener for WooCommerce plugin SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. SQL injection vulnerability exists in versions prior to WordPress Order Listener for WooCommerce plugin...