406 matches found
Input validation
An issue in the AST parser ast/compile.go of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2022-33082
An issue in the AST parser ast/compile.go of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2022-33082
An issue in the AST parser ast/compile.go of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2022-33082
CVE-2022-33082 affects Open Policy Agent (OPA). The issue is in the AST parser (ast/compile.go) and can cause a Denial of Service when processing specially crafted input, specifically for OPA v0.10.2. Multiple connected sources corroborate a DoS risk from the AST parser, with no public details on...
CVE-2022-34877
SQL Injection vulnerability in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailabl...
Open Policy Agent 安全漏洞
Open Policy Agent is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. A security vulnerability exists in Open Policy Agent v0.10.2, which stems from an issue in the AST parser ast/compile.go that allows an attacker to...
Improper Input Validation in Jenkins Script Security Plugin
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...
GHSA-CJR8-5RW4-WH65 Jenkins Splunk Plugin Sandbox Bypass
Jenkins Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST...
Jenkins Splunk Plugin Sandbox Bypass
Jenkins Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST...
Out of bounds memory access in github.com/open-policy-agent/opa
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service DoS via triggering out-of-range memory access...
new packages: hunspell-ast
An update is available for hunspell-ast. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
GHSA-WHF8-3H58-2W9F Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to...
Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability
Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to...
Jenkins Script Security Plugin sandbox bypass vulnerability
The previously implemented script security sandbox protections prohibiting the use of unsafe AST transforming annotations such as @Grab 2019-01-08 fix for SECURITY-1266 could be circumvented through use of various Groovy language features: - Use of AnnotationCollector - Import aliasing -...
GHSA-X6JX-CXG3-MGGH Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...
Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...
Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...
GHSA-6Q78-6XVR-26FG Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with...
Cross-site Scripting in Parsedown
Parsedown version prior to 1.7.0 contains a Cross Site Scripting XSS vulnerability in setMarkupEscaped for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST...
GHSA-QGPV-86R3-87FH Cross-site Scripting in Parsedown
Parsedown version prior to 1.7.0 contains a Cross Site Scripting XSS vulnerability in setMarkupEscaped for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST...