CVE-2022-20614: Missing Authorization

A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...

PT-2022-14823 · Jenkins · Jenkins Mailer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions 391.ve4a 38c1b cf4b and earlier Jenkins Mailer Plugin versions prior to 408.vd726a 1130320 and 1.34.2 Description: A missing permission check in the Jenkins Mailer Plugin allows attackers with Overall/Read acces...

Jenkins Plugin: Permissions, Licensing, and Access Control Vulnerabilities

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Mailer Plugin 391.ve4a 38c1b cf4b and prior versions are vulnerable to a privilege error. The vulnerability stems...

CVE-2022-20614

A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...

CVE-2022-20613

A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...

CSRF vulnerability and missing permission checks in mailer

mailer 391.ve4a38c1bcf4b and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form validation method does n...

January 11, 2022—KB5009601 (Security-only update)

January 11, 2022—KB5009601 Security-only update Applies To Windows Server 2008 Service Pack 2 Caution If you intend to install this update on a domain controller DC, we highly recommend that you install the February 8, 2022 security update instead. The February security update addresses a known...

CVE-2022-21919: Improper Link Resolution Before File Access

Windows User Profile Service Elevation of Privilege Vulnerability...

CVE-2022-21895: Improper Link Resolution Before File Access

Windows User Profile Service Elevation of Privilege Vulnerability...

Django Information Disclosure Vulnerability (CNVD-2022-31937)

Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. A security vulnerability exists in Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1...

PT-2022-1524 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Windows Cleanup Manager. It is caused by incorrect link resolution before accessing a file. Exploitation of this issue...

CVE-2022-21838: Improper Link Resolution Before File Access

Windows Cleanup Manager Elevation of Privilege Vulnerability...

SUSE-SU-2022:0042-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults. bsc1194041 - CVE-2021-3975: Add missing lock in qemuProcessHandleMonitorEOF. bsc1192876...

SUSE-SU-2022:0041-1 Security update for libvirt

This update for libvirt fixes the following issues: - CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults. bsc1194041 - CVE-2021-3975: Add missing lock in qemuProcessHandleMonitorEOF. bsc1192876...

CVE-2021-45231: Improper Link Resolution Before File Access

A link following privilege escalation vulnerability in Trend Micro Apex One on-prem and SaaS and Trend Micro Worry-Free Business Security 10.0 SP1 and Services could allow a local attacker to create a specially crafted file with arbitrary content which could grant local privilege escalation on th...

Log4Shell Strategic Response: 5 Practices for Vulnerability Management at Scale

This post is co-authored by Blake Cifelli, Senior Advisory Services Consultant. In today’s cybersecurity world, risks evolve faster than we can remediate them. To meet our goals and become resilient to these fast changes, we need the right balance of automation and human interaction. Enabling rap...

Information disclosure

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

Django input validation vulnerability

Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. A security vulnerability exists in Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1...

UBUNTU-CVE-2021-31566

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. ...

CVE-2021-31566

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. ...