CVE-2022-34174

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...

PT-2022-22053 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Date Parameter Plugin versions 0.0.4 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the Jenkins Date Parameter Plugin does not escape the name and description of Date paramete...

Mozilla Firefox SQL注入漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation. A SQL injection vulnerability exists in the history tab of Mozilla Firefox for iOS, which originates from the ability to externally specify a search term to trigger an SQL injection...

Security Vulnerabilities fixed in Firefox for iOS 101 — Mozilla

The search term could have been specified externally to trigger SQL injection...

GHSA-HVMC-7G2X-R3P9 Jenkins Cross-Site Scripting vulnerability in help icons

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting XSS vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the...

new packages: perl-Term-Table

An update is available for perl-Term-Table. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: perl-Term-Size-Any

An update is available for perl-Term-Size-Any. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: perl-Term-Cap

An update is available for perl-Term-Cap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-PJMX-4GC6-HWV8 Drupal cross-site scripting vulnerability via actions feature and trigger module

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via 1 an action description, 2 an action message, 3 a node, or 4 a taxonomy term, related to the actions feature and the...

Drupal cross-site scripting vulnerability via actions feature and trigger module

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via 1 an action description, 2 an action message, 3 a node, or 4 a taxonomy term, related to the actions feature and the...

GHSA-9C26-CF8C-MW43 Jenkins allows Remote Attackers to Hijack Sessions

The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors...

GHSA-QF2H-H3XQ-J93J Jenkins allows Remote Users to Inject Build Parameters

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...

GHSA-W7QM-FPRW-CQGQ Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

GHSA-742J-JCFR-23W3 Insufficient Session Expiration in Jenkins

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based...

Microsoft Excel 输入验证错误漏洞

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. An input validation error vulnerability exists in Microsoft Office Excel. The following products and editions are affected:Microsoft Office 2019 for 32-bit editions,Microsoft Office 2019 for...

Chinese "Override Panda" Hackers Resurface With New Espionage Attacks

A Chinese state-sponsored espionage group known as Override Panda has resurfaced in recent weeks with a new phishing attack with the goal of stealing sensitive information. "The Chinese APT used a spear-phishing email to deliver a beacon of a Red Team framework known as 'Viper,'" Cluster25 said i...

USN-5376-2 git vulnerability

USN-5376-1 fixed vulnerabilities in Git. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use this issue to run...

GHSA-X97G-3GP9-CF2P Jenkins allows Cross-Site Scripting (XSS) via Crafted URL

Cross-site Scripting XSS in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins...

The vulnerability of the long_term_filter function in the g729postfilter.c component of the FFmpeg multimedia library allows a hacker to gain access to confidential data.

The vulnerability of the longtermfilter function in the g729postfilter.c component of the FFmpeg multimedia library relates to reading data from buffer memory beyond its allowable limits. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

An update on Java 17+ adoption

As a follow-up to my blog post from last years SpringOne, it is time for an update on our Java 17+ baseline efforts! We established the new baseline on our main branches, with a few milestones out already. The feedback has been very positive, not only in terms of framework improvements but also i...