CVE-2020-2289

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2289

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

Cross site scripting

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

Cross site scripting

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2289

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2290

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

CVE-2020-2290

CVE-2020-2290 affects Jenkins Active Choices Plugin 2.4 and earlier. The vulnerability arises because some return values of sandboxed scripts for Reactive Reference Parameters (notably List and Map) are not escaped, enabling stored XSS. Exploitation requires Job/Configure permission. The issue is...

CVE-2020-2289

CVE-2020-2289 affects Jenkins with the Active Choices Plugin (versions 2.4 and earlier). The root cause is that the name and description of build parameters are not escaped, leading to a stored cross-site scripting (XSS) vulnerability. The impact is that an attacker with Job/Configure permission ...

PT-2020-15520 · Jenkins · Jenkins Active Choices Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Choices Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Job/Configure permission. This occurs because some return values ...

PT-2020-15519 · Jenkins · Jenkins Active Choices Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Choices Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because the name and description of build parameters are not properly escaped. This vulnerability can be...

The vulnerability of the Intel Active Management Technology implementation lies in the insufficient protection of registration data, which allows an intruder to gain unauthorized access to protected information.

The vulnerability of the Intel Active Management Technology implementation is related to insufficient protection of registration data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Intel Active Management Technology implementation lies in insufficient validation of input data, allowing a perpetrator to trigger a service failure.

The vulnerability of the Intel Active Management Technology implementation is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

Microsoft Zerologon Flaw Under Attack By Iranian Nation-State Actors

Microsoft is warning that an Iranian nation-state actor is now actively exploiting the Zerologon vulnerability CVE-2020-1472, adding fuel to the fire as the severe flaw continues to plague businesses. The advanced persistent threat APT actor, which Microsoft calls MERCURY also known as MuddyWater...

active-z.gr Cross Site Scripting vulnerability OBB-1382284

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

[SECURITY] Fedora 33 Update: rubygem-activemodel-6.0.3.3-1.fc33

A toolkit for building modeling frameworks like Active Record. Rich support for attributes, callbacks, validations, serialization, internationalization, and testing...

Fedora: Security Advisory for rubygem-activemodel (FEDORA-2020-4dd34860a3)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

smbAutoRelay - Provides The Automation Of SMB/NTLM Relay Technique For Pentesting And Red Teaming Exercises In Active Directory Environments

SMB AutoRelay provides the automation of SMB/NTLM Relay technique for pentesting and red teaming exercises in active directory environments. Usage Syntax: ./smbAutoRelay.sh -i -t -q -d . Example: ./smbAutoRelay.sh -i eth0 -t ./targets.txt . Notice that the targets file should contain just the IP...

Denial Of Service (DoS)

libvirt is vulnerable to denial of service. A potential application crash can occur via active pools that are created without a target path...

Windows Secrets Dump

Dumps SAM hashes and LSA secrets including cached creds from the remote Windows target without executing any agent locally. This is done by remotely updating the registry key security descriptor, taking advantage of the WriteDACL privileges held by local administrators to set temporary read...

Cisco Issues Patches For 2 High-Severity IOS XR Flaws Under Active Attacks

Cisco yesterday released security patches for two high-severity vulnerabilities affecting its IOS XR software that were found exploited in the wild a month ago. Tracked as CVE-2020-3566 and CVE-2020-3569, details for both zero-day unauthenticated DoS vulnerabilities were made public by Cisco late...