145 matches found
lesspipe: Arbitrary Code Exeecution
Background lesspipe is a preprocessor for less. Description lesspipe has support for parsing Perl storable "PST" files, Impact A crafted Perl storable file which is passed into lesspipe could result in arbitrary code execution. Workaround There is no known workaround at this time. Resolution All...
CVE-2022-44542
lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...
Design/Logic Flaw
lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...
CVE-2022-44542
lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...
CVE-2022-44542
CVE-2022-44542 affects lesspipe up to version 2.05; vulnerability arises from handling Perl Storable (pst) files where a crafted PST can trigger deserialized object destructor execution, enabling remote code execution. Impact is described as total compromise with high confidentiality, integrity, ...
CVE-2022-44542
lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...
Gentoo 代码问题漏洞
Gentoo is an open source Linux system from the Gentoo Foundation. A code issue vulnerability exists in Gentoo lesspipe versions prior to 2.06. An attacker can exploit this vulnerability to execute code via a Perl Storable pst file...
PT-2022-27228 · Lesspipe +1 · Lesspipe +1
Name of the Vulnerable Software and Affected Versions: lesspipe versions prior to 2.06 Description: The issue allows attackers to execute code via Perl Storable pst files. This is due to deserialized object destructor execution via a key/value pair in a hash. Recommendations: For versions prior t...
CVE-2022-44542
lesspipe before 2.06 allows attackers to execute code via Perl Storable pst files, because of deserialized object destructor execution via a key/value pair in a hash...
GHSA-QV6Q-4JWX-7J5C Arbitrary file write vulnerability in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content...
GHSA-85WG-CG5P-M76P Arbitrary file read vulnerability in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller...
Arbitrary file read vulnerability in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller...
Arbitrary file write vulnerability in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content...
Jenkins Storable Configs Plugin跨站请求伪造漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Storable Configs Plugin 1.0 and...
Jenkins Storable Configs Plugin XML External Entity Injection Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An XML external entity injection...
GHSA-RR2R-G6XM-58XJ Cross Site Request Forgery in Jenkins Storable Configs Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file e.g., archived artifacts that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery...
GHSA-WQMP-2P5R-RHFV XML External Entity Reference in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller...
Cross Site Request Forgery in Jenkins Storable Configs Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file e.g., archived artifacts that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery...
XML External Entity Reference in Jenkins Storable Configs Plugin
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller...
