CVE-2024-36401-WoodpeckerPlugin

CVE-2024-36401-WoodpeckerPlugin Introduzione CVE-2024-36401 scansione batch e sfruttamento, supporta iniezione personalizzata di memory shell 1. Scansione batch possibile 2. Il backend ha già filtrato gli URL basta inserire l'URL 3. È possibile generare e iniettare memory shell personalizzate per...

WordPress Woodpecker for WordPress plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'formname' Shortcode Attribute vulnerability discovered by Gilang - DJ in WordPress Plugin Woodpecker for WordPress versions = 3.0.4...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...