1871 matches found
CVE-2024-30450
CVE-2024-30450 is a Stored XSS affecting the OpenStreetMap for Gutenberg and WPBakery Page Builder plugin by Step-Byte-Service GmbH. The connected Red Hat record reiterates the description: Improper Neutralization of Input During Web Page Generation allowing stored XSS, affecting OpenStreetMap fo...
Okta Verify 安全漏洞
Okta Verify is a lightweight application from Okta that allows you to securely access your application with two-step verification, ensuring that you and only you have access to your application account. A security vulnerability exists in Okta Verify versions prior to 4.10.7 that stems from the...
PT-2024-18359 · Dassault Systèmes · Solidworks Desktop
Name of the Vulnerable Software and Affected Versions: SOLIDWORKS Desktop version 2024 Description: Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in...
CVE-2024-28834
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce...
SUSE CVE-2024-1753
A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...
AZL-42509 CVE-2024-1753 affecting package buildah 1.18.0-29
A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...
Cross Site Request Forgery (CSRF)
org.jenkins-ci.plugins: docker-build-step is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to inadequate validation of user inputs, allowing attackers to connect to an attacker-specified TCP or Unix socket URL and reconfigure the plugin using provided connection test...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: ko, gitsign, kube-rbac-proxy, grpc-health-probe, apko, sigstore-scaffolding, fulcio, gomplate, tkn, weaviate, zarf, step, flux-kustomize-controller, kargo, caddy, melange, sops, kubernetes-dashboard, zot, argo-workflows, policy-controller, skaffold, kubescape,...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: kots, argo-workflows-fips, kube-bench, amass, caddy-fips, trillian, trillian-fips, spicedb, argo-workflows, temporal-server, step, ferretdb, wavefront-collector-for-kubernetes, kube-bench-fips, step-ca, k3s, kine, falcosidekick-fips, src, temporal-server-fips, caddy...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: caddy, kube-bench, step-ca, temporal-server, ferretdb, argo-workflows, kots, src, kine, amass, spicedb, k3s, trillian, step...
CVE-2024-27289 vulnerabilities
Vulnerabilities for packages: caddy, step-ca, argo-workflows, kots, trillian, step...
GHSA-8H2M-54WH-GWJ3 Jenkins docker-build-step Plugin missing permission check
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...
GHSA-64C5-R2H5-C2FG Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...
Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...
Jenkins docker-build-step Plugin missing permission check
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...
CVE-2024-2216
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...
CVE-2024-2215
A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...
CVE-2024-2215
A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...
Design/Logic Flaw
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...