CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

Updated jenkins-remoting packages fix CVE-2016-0792

Updated jenkins-remoting packages fix security vulnerability: Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. SECURITY-247 ...

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

Design/Logic Flaw

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

CVE-2016-0792

CVE-2016-0792 affects Jenkins, including the core up to 1.650 and LTS up to 1.642.2, via a deserialization flaw in XML data using XStream and groovy.util.Expando. The vulnerability allows remote authenticated users to execute arbitrary code by crafting a serialized payload in an XML file. Public ...

PT-2016-4418 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2 Description: The issue allows remote authenticated users to execute arbitrary code via serialized data in an XML file. This is related to XStream and the groovy.util.Expand...

PT-2015-7410

Name of the Vulnerable Software and Affected Versions Nokia Networks @vantage Commander affected versions not specified Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including /cftraces/filter/fl copy.jsp,...

PT-2014-6491

Name of the Vulnerable Software and Affected Versions OpenEMR versions 4.1.2 Patch 7 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved through various parameters in different API endpoints, including layout id to...

PT-2014-8892

Name of the Vulnerable Software and Affected Versions Proticaret E-Commerce version 3.0 Description The issue allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request, specifically through "API Endpoints" that accept SOAP requests. This can lead to...

PT-2014-5437 · Red Hat · Spacewalk-Java +1

Name of the Vulnerable Software and Affected Versions: spacewalk-java version 2.0.2 Red Hat Network RHN Satellite versions 5.5 through 5.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as...

PT-2014-6415

Name of the Vulnerable Software and Affected Versions innovaphone PBX versions 10.00 sr11 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts. This can be achieved through crafted request...

PT-2014-6284

Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 5.6.3 Description The issue allows remote attackers to obtain the installation path via a direct request to various API endpoints, including "system/basics/editor.php", "system/view.php", "system/environment/file...

PT-2014-6085

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions 5.0.x through 5.2.x before 5.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as "user/ldap user/check dlg" or "user/radius...

PT-2014-5512

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM versions prior to 4.7.0 Description The issue allows remote attackers to execute arbitrary commands via crafted requests to specific API endpoints, including update system info debian package, ossec task, set ossim setup admin...

PT-2014-5516

Name of the Vulnerable Software and Affected Versions BarracudaDrive versions prior to 6.7.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in various API endpoints, including the role parameter to "roles.lsp", the name parameter to...

PT-2014-3587

Name of the Vulnerable Software and Affected Versions Xangati XSR versions prior to 11 Xangati XNR versions prior to 7 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in various parameters. This can be achieved through several API endpoints, including:...

PT-2014-4762

Name of the Vulnerable Software and Affected Versions BarracudaDrive versions prior to 6.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including "/Forum/manage/ForumManager.lsp" with sForumName or...

PT-2014-2677

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-812DRU router affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in various parameters, including wan network prefix, remote port, pptp...