308 matches found
Rundeck代码问题漏洞
Rundeck is an open source automation service with a Web console, command line tools, and WebAPI from Rundeck USA, which is primarily used to run automation tasks.A code issue vulnerability exists in Rundeck Enterprise Edition, which stems from the fact that an authenticated user can issue a POST...
Insecure Direct Object Reference
Rundeck is vulnerable to insecure direct object reference. Due to lack of checking appropriate authorization level for API requests, a user can send a malicious API request to perform an unauthorized disclosure of execution data, logs and Job details at various threat level depending on the usage...
Rundeck Information Disclosure Vulnerability
Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. in the United States, which is used to run automation tasks. A security leak exists in Rundeck versions prior to 3.2.6. An attacker can exploit the vulnerability by sending a request ...
CVE-2020-11009
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
CVE-2020-11009
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
Authentication flaw
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
IDOR can reveal execution data and logs to unauthorized user in Rundeck
Impact Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is...
GHSA-5679-7QRC-5M7J IDOR can reveal execution data and logs to unauthorized user in Rundeck
Impact Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is...
CVE-2020-11009
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
CVE-2020-11009 IDOR can reveal execution data and logs to unauthorized user in Rundeck
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
CVE-2020-11009
CVE-2020-11009 affects Rundeck prior to 3.2.6. Authenticated users can craft requests to disclose Execution data, logs, and Job details they are not authorized to see (possible high confidentiality impact). Patches exist in version 3.2.6; upgrade Rundeck to 3.2.6 or apply vendor advisories (GHSA-...
PT-2020-12489
Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 3.2.6 Description The issue allows authenticated users to craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Runde...
CVE-2020-11009: Exposure of Sensitive Information to an Unauthorized Actor
In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very...
CloudBees Jenkins Rundeck plugin code issue vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Rundeck Plugin is used in one of the...
CVE-2020-2144
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2020-2144
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
Xxe
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2020-2144
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2020-2144
Summary: CVE-2020-2144 affects the Jenkins Rundeck Plugin, version 3.6.6 and earlier. The underlying issue is that the plugin’s XML parser does not disable XML External Entity (XXE) processing, which can enable a user with read access to submit crafted XML that leverages external entities, potent...
