Arbitrary file read vulnerability in Git server Plugin can lead to RCE

Jenkins Git server Plugin uses the args4j library to parse command arguments and options on the Jenkins controller when processing Git commands received via SSH. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents...

Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...

GHSA-6F9G-CXWR-Q5JR Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...

CVE-2024-23899

Technical details about CVE-2024-23899 are not publicly available in the connected documents provided. The initial description contains some specifics, but no further technical root cause, affected versions, or fixes are confirmed here. Monitor for updates.

CVE-2024-21765

Electronic Delivery Check System Doboku Ver.18.1.0 and earlier, Electronic Delivery Check System Dentsu Ver.12.1.0 and earlier, Electronic Delivery Check System Kikai Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML...

CVE-2024-22380

Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file,...

Arbitrary file read vulnerability through the CLI can lead to RCE

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the https://github.com/kohsuke/args4jargs4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature...

CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an ‘@’ character followed by a file path in an argument with the file’s contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system...

Jenkins cli Ampersand Replacement Arbitrary File Read

This module utilizes the Jenkins cli protocol to run the help command. The cli is accessible with read-only permissions by default, which are all thats required. Jenkins cli utilizes args4j's parseArgument, which calls expandAtFiles to replace any @ with the contents of a file. We are then able t...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description Critical SECURITY-3314 / CVE-2024-23897 Arbitrary file read vulnerability through the CLI can lead to RCE Description High SECURITY-3315 / CVE-2024-23898 Cross-site WebSocket hijacking vulnerability in the CLI...

Apple macOS Sonoma Security Vulnerability

Apple macOS Sonoma is a desktop operating system from Apple, Inc. A security vulnerability exists in Apple macOS Sonoma version 14.2, which originates from an application that may be able to read arbitrary files...

CVE-2023-51926

YonBIP v323.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component...

CVE-2023-51926

YonBIP v323.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component...

CVE-2023-51926

YonBIP v3_23.05 is affected by an arbitrary file read vulnerability in the nc.bs.framework.comn.serv.CommonServletDispatcher component. The issue is described across multiple sources consistent with CVE-2023-51926, with a CVSSv3.1 base score of 7.5 (High) and a network-based attack vector requiri...

YonBIP 安全漏洞

YonBIP is a new generation of products developed by UFIDA, as the world's leading enterprise digital intelligence platform and application software. An arbitrary file read vulnerability exists in YonBIP, which can be exploited by an attacker to read the contents of system files...

CVE-2023-51926

YonBIP v323.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component...

CVE-2023-52288

The CVE-2023-52288 entry concerns the Flaskcode package for Python (versions up to 0.0.8). The vulnerability is an unauthenticated directory traversal that can be exploited via a GET request to /resource-data/.txt (from views.py), enabling reading of arbitrary files on the server. Connected advis...

Rapid Software Rapid SCADA Path Traversal Vulnerability

Rapid Software Rapid SCADA is an open source industrial automation platform from Rapid Software. A security vulnerability exists in Rapid Software Rapid SCADA version 5.8.4 and earlier, which stems from the presence of a path traversal vulnerability. An attacker can exploit this vulnerability to...

PT-2024-1445 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to errors in handling relative path to directory, allowing an attacker to read arbitrary files from the system by appending path traversal characters to the filename when...

CVE-2023-49863

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLwebpimage parameter...