Stored XSS vulnerability in update center

Jenkins did not properly escape the update site URL in some status messages shown in the update center, resulting in a stored cross-site scripting vulnerability that is exploitable by administrators and affects other administrators. Jenkins now escapes the update site URL in status messages shown...

Denial Of Service (DoS)

jenkins is vulnerable to denial of service. A remotely authenticated user is able to cause a denial of service condition caused by improper plug-in and tool installation via malicious update center data...

CloudBees Jenkins Improper Authorization Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

Authorization

A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center...

Unauthorized users could cancel scheduled restarts initiated from the update center

Users with Overall/Read permission were able to access the URL used to cancel scheduled restart jobs initiated via the update center "Restart Jenkins when installation is complete and no jobs are running" due to a lack of permission checks. Access to the affected URL is now limited to users with...

Siemens LOGO! Soft Comfort Man-in-the-Middle Attack Vulnerability

LOGO! Soft Comfort is a Siemens LOGO! programming software that supports the addition of text display modules. A man-in-the-middle attack vulnerability exists in Siemens LOGO! Soft Comfort due to a lack of integrity validation of downloaded packages in Soft Comfort, the update center for LOGO!,...

Joomla aWeb Cart Watching System for Virtuemart 2.6.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching = 2.6.0 Date: 28-12-2016 Software Link: http://awebsupport.com/products/aweb-cartwatching-system Exploit Author: Javi Espejoqemm Contact:...

jenkins: update center metadata retrieval DoS attack (SECURITY-163)

A denial of service flaw was found in the way Jenkins handled certain update center data. An authenticated user could provide specially crafted update center data to Jenkins, causing plug-in and tool installation to not work properly...

CloudBees Jenkins CI and LTS Denial of Service Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A security vulnerability exists in CloudBees Jenkins CI versions prior to 1.600 and LTS versions prior to 1.596.1. A remote attacker can...

CVE-2015-1808

CVE-2015-1808 affects Jenkins before 1.600 and LTS before 1.596.1. It enables a remote authenticated user to cause a Denial of Service by sending specially crafted update center data, disrupting plugin and tool installations. The issue is limited to authenticated scenarios and relies on manipulat...

CVE-2015-1808

Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service improper plug-in and tool installation via crafted update center data...

PT-2015-5451

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.600 Jenkins LTS versions prior to 1.596.1 Description The issue allows remote authenticated users to cause a denial of service through improper plug-in and tool installation via crafted update center data...

CVE-2015-1808: Improper Input Validation

Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service improper plug-in and tool installation via crafted update center data...

jenkins: update center metadata retrieval DoS attack (SECURITY-163)

A denial of service flaw was found in the way Jenkins handled certain update center data. An authenticated user could provide specially crafted update center data to Jenkins, causing plug-in and tool installation to not work properly...

LG Handsets' App Update Doesn't Verify SSL Cert, Could Lead to Hijacking

Many smartphones manufactured by LG contain a vulnerability that can allow an attacker to replace an APK file with a malicious file of his choice. The problem is the result of several conditions on LG phones. Like other manufacturers, LG includes custom apps on its handsets, which are not availab...

jenkins -- multiple vulnerabilities

Kohsuke Kawaguchi from Jenkins team reports: Description SECURITY-125 Combination filter Groovy script unsecured This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. SECURITY-162 directory traversal...

LG On Screen Phone authentication bypass (CVE-2014-8757)

LG On Screen Phone authentication bypass vulnerability ------------------------------------------------------ SEARCH-LAB Ltd. discovered a serious security vulnerability in the On Screen Phone protocol used by LG Smart Phones. A malicious attacker is able to bypass the authentication phase of the...