CVE-2022-34179

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Cross site scripting

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Path traversal

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

Malicious Package

Overview @atresmedia/intranet-svg is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview spr-svg-loaders is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

CVE-2022-34179

CVE-2022-34179 affects Jenkins Embeddable Build Status Plugin, version 2.0.3 and earlier. The vulnerability arises from an unrestricted style query parameter used to select SVG image styles, enabling relative path traversal to SVGs on the Jenkins controller filesystem. Exploitation is possible wi...

CVE-2022-34179

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34171

CVE-2022-34171 – Jenkins XSS in icon HTML output : Affected Jenkins core versions: 2.321–2.355 and LTS 2.332.1–2.332.3. The HTML output for new symbol-based SVG icons exposes the title attribute of l:ionicon and the alt attribute of l:icon without proper escaping, enabling cross-site scripting vi...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Jenkins Plugin Embeddable Build Status 路径遍历漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Embeddable Build Status Plugin 2.0...

The vulnerability of Adobe InDesign’s computer layout automation tool, related to writing beyond the buffer in memory, allows a hacker to execute arbitrary code.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created data within SVG images...

Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7380 Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2993 Malicious code in feast-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6479c56289654bbc558ea4a0c5190871258655ce3fa766da8a33493aa24269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feast-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6479c56289654bbc558ea4a0c5190871258655ce3fa766da8a33493aa24269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-661 Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spr-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a0110f4b8f50e4633d5a315a6d446989ffe4e78d529a0d9aaa01a59d28229d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...