CVE-2023-30528

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it...

MAL-2023-58 Malicious code in @superbet-group/betting.lib.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e13a890da5a2b84f4c5c94e43e43e10ee158f2e3034a8e4458997ccbc5f5af51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...

`aliyun-oss-client` secret exposure

The aliyun-oss-client unintentionally divulges the authentication secret. This bug was fixed in this commit by limiting the concerned traits to be pub only within the crate...

OESA-2022-2062 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0,...

WordPress plugin Simple Single Sign On 加密问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

MAL-2022-2967 Malicious code in fasclck (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 660c53cfb85a6a700bd046082a978aaf7483745fd4c9f96fcbaa21db536c0122 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-20596 · Next-Auth · Next-Auth

Name of the Vulnerable Software and Affected Versions: next-auth versions prior to v4.10.2 next-auth versions prior to v3.29.9 Description: An information disclosure issue allows an attacker with log access privilege to obtain excessive information, such as an identity provider's secret in the lo...

PT-2022-18854 · Jenkins · Jenkins Pipeline: Phoenix Autotest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier Description: The issue is related to the Phoenix AutoTest Plugin not configuring its XML parser to prevent XML external entity XXE attacks. This allows attackers who can contr...

Jenkins Coverage/Complexity Scatter Plot Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An XML external entity injection...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-twisted) security update

An update for python-twisted is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Jenkins Plugin Semantic Versioning 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An access control error vulnerability exis...

SUSE: Security Advisory (SUSE-SU-2022:0734-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0734-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects bsc1195667, GHSA-92x2-jw7w-xvvx from...

SUSE-SU-2022:0499-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects by properly removing sensitive headers when redirecting to a different origin bsc1195667...

OPENSUSE-SU-2022:0499-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects by properly removing sensitive headers when redirecting to a different origin bsc1195667...

CVE-2021-43053 TIBCO FTL Secret Exposure Vulnerability

The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a difficult to exploit vulnerability that allows an unauthenticated attacker with network access to obtain the cluster secret of another...

TIBCO Security Advisory: January 11, 2022 - TIBCO FTL -2021-43053

TIBCO FTL Secret Exposure Vulnerability Original release date: January 11, 2022 Last revised:--- CVE-2021-43053 Source: TIBCO SoftwareInc. Products Affected TIBCO FTL - Community Edition versions 6.7.2 and below TIBCO FTL - Developer Edition versions 6.7.2 and below TIBCO FTL - Enterprise Edition...

Medium: docker

Issue Overview: Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemonunix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. CVE-2018-20699 A command injectio...

PT-2021-23881 · Jenkins · Jenkins Pom2Config Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins pom2config Plugin versions 1.2 and earlier Description: The issue allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the...