CVE-2020-27195: Undefined Security Weakness

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

nomad -- multiple vulnerabilities

The HashiCorp team reports: artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. template: Fixed a bug where interpolation can be used in the template source and destination fields to read or write fil...

Technical Approaches to Uncovering and Remediating Malicious Activity

Summary This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,1 Canada,2 New Zealand,34 the United Kingdom,5 and the United States.6 It highlights technical approaches to uncovering malicious activity and includes mitigati...

Content-Security-Policy protection for user content disabled by ZAP Pipeline

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts. ZAP Pipeline 1.9 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins. Th...

PT-2020-13415 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.0.1 GitLab CE/EE affected versions not specified Description: A security issue in GitLab allowed attackers to achieve Denial of Service attacks through memory exhaustion. This was possible by uploading malicious...

Malicious Code Injection

guvnor-m2repo-editor-backend is vulnerable to malicious code injection. The attacker can inject arbitrary code by uploading a pom.xml with errors to business central using Artifact Repository as the upload function shows the error message in an HTML mode...

OS command injection vulnerability in Play Framework

A form validation endpoint in Play Framework executes the play command to validate a given input file. Play Framework 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to sto...

CloudBees Jenkins Copy Artifact Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . Copy Artifact Plugin is used in one of the...

CVE-2020-2183

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

CVE-2020-2183

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

Design/Logic Flaw

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

CVE-2020-2183

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

CVE-2020-2183

CVE-2020-2183 affects Jenkins Copy Artifact Plugin (versions 1.43.1 and earlier). The issue is improper permission checks that allow an attacker to copy artifacts from jobs they are not authorized to access, typically leveraging Job/Configure permissions. Impact is elevated artifact leakage acros...

CVE-2020-2183

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

Improper permission checks in copyartifact

copyartifact 1.43.1 and earlier performs improper permission checks when determining whether a build can copy artifacts from another project build. This allows attackers, usually with Job/Configure permission, to configure jobs to copy artifacts from jobs they have no permission to access...

PT-2020-15396 · Jenkins · Jenkins Artifactory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Copy Artifact Plugin versions 1.43.1 and earlier Description: The issue arises from improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access. This is particularly concerning for...

CVE-2020-2183: Incorrect Default Permissions

Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access...

CVE-2020-11506

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...

CVE-2020-11506

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...

Arbitrary file deletion

An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure Exposure of Sensitive Information via request smuggling...