CVE-2022-23644 Server-side request forgery in BookWyrm

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-25175

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...

CVE-2022-25179

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the...

PT-2022-17114 · Jenkins · Jenkins Pipeline: Multibranch Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier Description: The issue allows attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This is possibl...

Jenkins Pipeline: Multibranch Plugin 操作系统命令注入漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Pipeline:...

YzmCMS 跨站请求伪造漏洞

YzmCMS is an open source CMS Content Management System.A cross-site request spoofing vulnerability exists in YzmCMS, which stems from insufficient validation in admin.add that the request is coming from a trusted user. An attacker could use this vulnerability to spoof malicious requests to trick...

PT-2022-17118 · Jenkins · Jenkins Pipeline: Multibranch Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier Jenkins Pipeline: Multibranch Plugin prior to 2.23.1, 2.26.1, 696.698.v9b4218eea50f, and 707.v71c3f0a 6ccdb Description: The issue allows attackers with permission to...

Jenkins Pipeline 后置链接漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins Pipeline Multibranch Plugin 706.vd43c65dec013 and earlier versions contain an arbitrary file reading vulnerability...

CVE-2021-39079

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2021-39079

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

PeerTube Server-Side Request Forgery Vulnerability (CNVD-2022-18320)

PeerTube is a decentralized video sharing service platform. PeerTube suffers from a server-side request forgery vulnerability, which stems from the product's failure to determine that requests originate from trusted users, and can be exploited by attackers to send unintended requests to the serve...

microweber cross-site request forgery vulnerability (CNVD-2022-12800)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in microweber because the product does...

OESA-2022-1515 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as...

Gitea Input Validation Error Vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an input validation error that stems from the product's failure to determine that a request originated from a trusted user, which could be exploited to send an unintended request to the server...

PT-2022-8501 · Quickedit · Quickedit

Name of the Vulnerable Software and Affected Versions: QuickEdit module affected versions not specified Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues...

PT-2022-28163 · Apache · Maven Enforcer Plugin

Name of the Vulnerable Software and Affected Versions: Artemis Java Test Sandbox versions prior to 1.8.0 Description: The issue allows an attacker to escape the sandbox by including class files in a package that Ares trusts, enabling the execution of arbitrary Java code when a victim runs the...

Microweber 跨站请求伪造漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in microweber because the product does...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea, which stems from the failure of some of the product's user APIs to determine that a request originates from a trusted user. The vulnerability can be exploited to execute...

Important: kernel

Issue Overview: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service...

[WP-H2] Funds can be frozen when critical key holders lose access to their keys

Lines of code Vulnerability details The current implementation requires trusted key holders Owner to send transactions finalize to finalize the sale before the buyers can claim the tokenOut from the contract. function finalize external onlyOwner require!finalized, "TokenSale: already finalized";...