Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE via ExpectedArtifactExpressionEvaluationPostProcessor, which may accept and process SpEL expressions that reference and load arbitrary classes. An attacker can execute code by supplying malicious strings as inp...

GO-2024-2608 Minder access control bypass in github.com/stacklok/minder

A Minder user can use the endpoints to access any repository in the DB, irrespective of who owns the repo and any permissions that user may have. The DB query used checks by repo owner, repo name and provider name which is always "github". These query values are not distinct for the particular...

CloudBees Jenkins Repository Connector Plugin Cross-Site Scripting Vulnerability

Jenkins Repository Connector is a Jenkins open source application plugin . Provides a repository from Nexus or Artifactory or the like to retrieve artifacts or deploy artifacts from it , as well as the realization of the repository layout of the static server . A cross-site script execution...