CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-20618

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2022-20616

Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file...

CVE-2022-23115

Cross-site request forgery CSRF vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task...

CVE-2022-23112

CVE-2022-23112 concerns Jenkins Publish Over SSH Plugin, versions 1.22 and earlier. The root cause is a missing permission check that allows users with Overall/Read access to cause the controller to connect to an attacker‑specified SSH server using attacker‑supplied credentials. This enables pote...

CVE-2022-20620

Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2022-20618

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...

PT-2022-15858 · Jenkins · Jenkins Batch Task Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins batch task Plugin versions 1.19 and earlier Description: The issue allows attackers with Overall/Read access to perform certain actions due to cross-site request forgery CSRF vulnerabilities. These actions include retrieving logs,...

PT-2022-15855 · Jenkins · Jenkins Publish Over Ssh Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials...

PT-2022-14825 · Jenkins · Jenkins Credentials Binding Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin versions 1.27 and earlier Jenkins Credentials Binding Plugin versions prior to 1.27.1 Jenkins Credentials Binding Plugin versions prior to 1.24.1 Description: The issue allows attackers with Overall/Read...

PT-2022-14829 · Jenkins · Jenkins Ssh Agent Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SSH Agent Plugin versions 1.23 and earlier Jenkins SSH Agent Plugin versions prior to 1.23.2 and 1.22.1 Description: The issue is related to missing permission checks in the Jenkins SSH Agent Plugin, which allows attackers with...

Jenkins 插件 权限许可和访问控制问题漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.The Jenkins Credentials Binding Plugin is vulnerable to an input validation error that stems from the plugin's failure to...

CVE-2022-20614

A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...

Ubuntu 21.10 : libslirp vulnerabilities (USN-5009-2)

The remote Ubuntu 21.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5009-2 advisory. USN-5009-1 fixed vulnerabilities in libslirp. This update provides the corresponding updates for Ubuntu 21.10. Tenable has extracted the preceding descriptio...

CVE-2021-43845

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA a...

CVE-2021-43845 Prevent out-of-bounds read in PJSIP

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA a...

CVE-2021-45101

An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data...

DEBIAN-CVE-2021-45101

An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data...

UBUNTU-CVE-2021-45101

An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data...

The vulnerability of the Jenkins automation server, related to the use of an incomplete blacklist, allows a malicious actor to read and write the contents of any build catalog.

The vulnerability of the Jenkins automation server relates to the use of an incomplete blacklist. Exploiting this vulnerability allows a malicious actor to read and write the contents of any build catalog...