CVE-2019-16553

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression...

CVE-2019-16553

The CVE-2019-16553 entry concerns Jenkins Build Failure Analyzer Plugin, affected through versions 1.24.1 and earlier. The vulnerability is a cross-site request forgery (CSRF) flaw that allows an attacker to trigger Jenkins to evaluate a computationally expensive regular expression, exposing perf...

CVE-2019-16553

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression...

PT-2019-14710 · Jenkins · Jenkins Build Failure Analyzer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Failure Analyzer Plugin versions 1.24.1 and earlier Description: The issue allows attackers to have Jenkins evaluate a user-supplied regular expression without the ability to interrupt this process, as the regular expression was...

CVE-2019-16554: Incorrect Default Permissions

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression...

CVE-2019-16555: Uncontrolled Resource Consumption

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process...

CVE-2019-16553: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression...

CSRF vulnerability and missing permission check in build-failure-analyzer allow ReDoS

build-failure-analyzer 1.24.1 and earlier does not perform a permission check in a method performing form validation. This allows users with Overall/Read access to supply a computationally expensive regular expression that will hang the request handling thread. Additionally, this form validation...

ZOHO ManageEngine EventLog Analyzer Access Control Error Vulnerability

ZOHO ManageEngine EventLog Analyzer is the United States ZhuoHao ZOHO company's set of system, event log analysis software. The software is capable of network-wide hosts, servers, network equipment and a variety of application service systems and other logs generated by the comprehensive collecti...

CVE-2019-19774

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data...

CVE-2019-19774

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data...

CVE-2019-19774

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data...

CVE-2019-19774

CVE-2019-19774 affects Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. An authenticated user can bypass access controls via the /event/runquery.do endpoint by executing the query select hostdetails from hostdetails, bypassing restrictions that prevent viewing credential data and ...

ZOHO ManageEngine EventLog Analyzer CVE-2019-19774 Security Bypass Vulnerability

Description ZOHO ManageEngine EventLog Analyzer is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in launching further attacks. ManageEngine EventLog Analyzer 10.0 SP1 is vulnerabl...

CVE-2019-19774: Undefined Security Weakness

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data...

Security Bulletin: IBM InfoSphere Information Analyzer is affected by an AngularJS client-side template injection vulnerability

Summary An AngularJS client-side template injection vulnerability was addressed by IBM InfoSphere Information Analyzer. Vulnerability Details CVEID: CVE-2019-4660DESCRIPTION: It is possible to inject AngularJS template syntax in an internal page request within Information Analyzer, which is...

Fedora Update for hunspell FEDORA-2019-656f7ac8ca

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: hunspell-1.7.0-4.fc30

Hunspell is a spell checker and morphological analyzer library and program designed for languages with rich morphology and complex word compounding or character encoding. Hunspell interfaces: Ispell-like terminal interface usi ng Curses library, Ispell pipe interface, LibreOffice UNO module...

[SECURITY] Fedora 31 Update: mingw-hunspell-1.7.0-6.fc31

Hunspell is a spell checker and morphological analyzer library and program designed for languages with rich morphology and complex word compounding or character encoding. Hunspell interfaces: Ispell-like terminal interface usi ng Curses library, Ispell pipe interface, OpenOffice.org UNO module...

Zoho ManageEngine OpManager and Firewall Analyzer Elevation of Privilege Vulnerability

Zoho ManageEngine OpManager and Zoho ManageEngine Firewall Analyzer are both products from Zoho, Inc. Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software. Zoho ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects,...