CVE-2019-10458

Summary (facts from documents): Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier is affected by an unsafe Script Security whitelist that can let attackers executing Script Security protected scripts run arbitrary code. Affected component: Jenkins Puppet Enterprise Pipeline plugin; vulnerable ...

CVE-2019-10458

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10458

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10458: Undefined Security Weakness

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

Script sandbox bypass vulnerability in Puppet Enterprise Pipeline

Puppet Enterprise Pipeline defines a custom list of pre-approved signatures for all scripts protected by the Script Security sandbox. This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code...

PT-2019-11852 · Puppet +1 · Jenkins Puppet Enterprise Pipeline +1

Name of the Vulnerable Software and Affected Versions: Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier Description: The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Securit...

CloudBees Jenkins Script Security Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release , test projects and some timed tasks . Dependency Graph Viewer Plugin is used in whic...

SugarCRM 9.0.1 SQL Injection

-------------------------------------------------------- SugarCRM = 9.0.1 Multiple SQL Injection Vulnerabilities -------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and prior versions. -...

Unspecified Vulnerability in CloudBees Jenkins Kubernetes::Pipeline::Kubernetes Steps Plugin

CloudBees Jenkins Hudson Labs is a set of U.S. CloudBees company based on Java development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks.Kubernetes::Pipeline::Arquillian Steps Plugin is used in...

CVE-2019-10431

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

CVE-2019-10431

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

Security feature bypass

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +250 more potentially affected by CVE-2019-10431 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.64)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2019-10431 Source advisory: MEND:CVE-2019-10431...

CVE-2019-10431

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

CVE-2019-10431

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

CVE-2019-10431

CVE-2019-10431 relates to a sandbox bypass in Jenkins Script Security Plugin (versions 1.64 and earlier) where improper handling of default parameter expressions in constructors could allow an attacker to run arbitrary code in sandboxed scripts. The issue is described in the GitHub advisory GHSA-...

Multiple Jenkins Plugins Multiple Security Vulnerabilities

Description Jenkins plugins are prone to the following vulnerabilities: 1. A HTML-injection vulnerability 2. Multiple information-disclosure vulnerabilities 3. A security-bypass vulnerability An attacker may leverage these issues to steal cookie-based authentication credentials, gain access to...

Sandbox bypass vulnerability in script-security

Sandbox protection in script-security could be circumvented through default parameter expressions in constructors. This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM. These expressions are now subject to sandbox...

CVE-2019-10431: Improper Control of Generation of Code

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts...

PT-2019-11825 · Jenkins · Jenkins Script Security Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Script Security Plugin versions 1.64 and earlier Description: A sandbox bypass issue related to the handling of default parameter expressions in constructors allows attackers to execute arbitrary code in sandboxed scripts...