SolarWinds Database Performance Analyzer Cross-Site Scripting Vulnerability

SolarWinds Database Performance Analyzer is a set of database performance analyzers from SolarWinds Solarwinds, USA. The product is used for SQL query performance monitoring, analysis and tuning and so on. A cross-site scripting vulnerability exists in SolarWinds Database Performance Analyzer DPA...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

PT-2020-16641

Name of the Vulnerable Software and Affected Versions Kata Containers versions 1.11.3 and earlier Kata Containers versions 2.x through 2.0-rc1 Description An issue was discovered in Kata Containers where the runtime will execute binaries given using annotations without any kind of validation. Thi...

CVE-2020-27151: Undefined Security Weakness

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

Cron Utils Injection Vulnerability

Cron Utils is a Java codebase for authenticating, parsing, and migrating Cron expressions from the individual developers at Jmrozanec. An injection vulnerability exists in Cron-utils versions prior to 9.1.3, which can be exploited by an attacker to be able to inject arbitrary Java EL expressions,...

Red Hat Hibernate ORM SQL Injection Vulnerability

Red Hat Hibernate ORM is an object/relational mapping ORM framework for writing applications from Red Hat. Hibernate ORM suffers from a SQL injection vulnerability that can be exploited by an attacker to read or modify data via annotations in Hibernate ORM using SQL injection...

org.mortbay.jetty.example:jetty-embedded (7.0.0.pre4), org.mortbay.jetty:jetty-annotations (7.0.0.pre4) +12 more potentially affected by CVE-2020-27216 via org.mortbay.jetty:jetty-webapp (7.0.0.pre4)

org.mortbay.jetty:jetty-webapp MAVEN version 7.0.0.pre4 is affected by a known vulnerability. The following packages have a transitive dependency on org.mortbay.jetty:jetty-webapp and may be impacted: - org.mortbay.jetty.example:jetty-embedded 7.0.0.pre4 - org.mortbay.jetty:jetty-annotations...

org.eclipse.jetty:jetty-annotations (7.0.0.m0), org.eclipse.jetty:jetty-deploy (7.0.0.m0) +7 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.0.0.m0)

org.eclipse.jetty:jetty-webapp MAVEN version 7.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty:jetty-annotations 7.0.0.m0 - org.eclipse.jetty:jetty-deploy 7.0.0.m0 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc2) +23 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (8.1.0.rc2)

org.eclipse.jetty:jetty-webapp MAVEN version 8.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.2.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.2.rc0) +22 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.0.2.rc0)

org.eclipse.jetty:jetty-webapp MAVEN version 7.0.2.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.2.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (8.1.1.v20120215), org.eclipse.jetty.aggregate:jetty-all-server (8.1.1.v20120215) +26 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (8.1.1.v20120215)

org.eclipse.jetty:jetty-webapp MAVEN version 8.1.1.v20120215 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.1.v20120215 -...

org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.6.0.rc0) +26 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.6.0.rc0)

org.eclipse.jetty:jetty-webapp MAVEN version 7.6.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.5.1.v20110908), org.eclipse.jetty.aggregate:jetty-all-server (7.5.1.v20110908) +35 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.5.1.v20110908)

org.eclipse.jetty:jetty-webapp MAVEN version 7.5.1.v20110908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.1.v20110908 -...

jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

GitLab: Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ...

Summary Similar bug to 858671, but this time with annotations mutation: DeleteAnnotation in app/graphql/mutations/metrics/dashboard/annotations/base.rb ruby module Mutations module Metrics module Dashboard module Annotations class Base " clientMutationId 3. Project disappear along with Repository...

jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

Remote Code Execution (RCE)

jenkins-script-security-plugin is vulnerabl to sandbox protection bypass during script compilation phase by applying AST transforming annotations...

jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

CVE-2019-1003005

A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code...

Fedora: Security Advisory for python3-typed_ast (FEDORA-2020-9b3dabc21c)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...