Jenkins Job Generator Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application software.Jenkins Job Generator Plugin has...

PT-2022-19382 · Jenkins · Jenkins Job Generator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Generator Plugin versions 1.22 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the Jenkins Job Generator Plugin does not escape the name and description of...

CVE-2022-24815

CVE-2022-24815 affects JHipster-generated applications that use a SQL database with reactive Spring WebFlux. The vulnerability resides in the entity repository’s findAllBy(Pageable, Criteria) where clause, where Criteria.toString() is not sanitized and user input is passed through directly, enabl...

PT-2022-17409

Name of the Vulnerable Software and Affected Versions StylemixThemes eRoom – Zoom Meetings & Webinar WordPress plugin versions 1.3.7 and earlier Description The issue concerns a Cross-Site Request Forgery CSRF that allows an attacker to perform unauthorized actions, specifically to Sync with Zoom...

CVE-2022-25614: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in StylemixThemes eRoom – Zoom Meetings & Webinar WordPress plugin = 1.3.7 allows an attacker to Sync with Zoom Meetings...

PT-2022-11867

Name of the Vulnerable Software and Affected Versions zlog version 1.2.15 Description A Buffer Overflow issue exists via the zlog conf build with file function in src/zlog/src/conf.c. This allows for potential exploitation. No information is provided about the estimated number of potentially...

Xen Hypervisor Loop DoS

The vulnerability of Xen hypervisors relates to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability allows an attacker to cause a service failure...

PT-2022-15413

Name of the Vulnerable Software and Affected Versions IBM Watson Query with Cloud Pak for Data as a Service affected versions not specified Description The issue allows an authenticated user to obtain sensitive information, potentially enabling them to examine or alter system configurations or da...

Beers with Talos, Ep. #119: If it walks like a BlackCat, smells like a BlackCat...

Beers with Talos BWT Podcast episode No. 119 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded March 25, 2022. If iTunes and Google Play aren't your thing, click here. We're... This is only the beginning! Please visi...

PT-2022-17755

Name of the Vulnerable Software and Affected Versions Suzuki Connect version 1.0.15 Description The issue allows attackers to tamper with displayed messages via spoofed CAN messages. Recommendations For Suzuki Connect version 1.0.15, consider restricting access to the CAN bus to minimize the risk...

Missing permission check in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. ci-with-toad-edge 2.4 requires...

Path traversal vulnerability on Windows in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core DirectoryBrowserSupport to serve reports. The fork did not receive the fix for SECURITY-2481 in Jenkins 2.315 and LTS 2.303.2. This...

Arbitrary file read vulnerability in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps. ci-with-toad-edge 2.4 only allows copying files from the node the build is...

CVE-2022-24303

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled...

WordPress plugin Translate WordPress with GTranslate 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Translate WordPress with GTranslate plugin version 2.9.9 is vulnerable to cross-site request forgery. The vulnerability...

CVE-2022-0770: Cross-Site Request Forgery (CSRF)

The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access t...

[SECURITY] Fedora 36 Update: cobbler-3.3.1-1.fc36

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...

CVE-2022-26188

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost...

mariadb: save_window_function_values triggers an abort during IN subquery

savewindowfunctionvalues in MariaDB before 10.6.3 allows an application crash because of incorrect handling of withwindowfunc=true for a subquery...

mariadb: save_window_function_values triggers an abort during IN subquery

savewindowfunctionvalues in MariaDB before 10.6.3 allows an application crash because of incorrect handling of withwindowfunc=true for a subquery...