[ASA-202101-41] jenkins: multiple issues

Arch Linux Security Advisory ASA-202101-41 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21602 CVE-2021-21603 CVE-2021-21604 CVE-2021-21605 CVE-2021-21606 CVE-2021-21607 CVE-2021-21608 CVE-2021-21609 CVE-2021-21610 CVE-2021-21611 Package : jenkins...

Js-X-Ray - JavaScript And Node.js Open-Source SAST Scanner (A Static Analysis Of Detecting Most Common Malicious Patterns)

JavaScript AST analysis. This package has been created to export the Node-Secure AST Analysis to enable better code evolution and allow better access to developers and researchers. The goal is to quickly identify dangerous code and patterns for developers and Security researchers. Interpreting th...

jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

ast-gun.airsofttaiwan.com Cross Site Scripting vulnerability OBB-1288885

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST transforming annotations

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

Remote Code Execution (RCE)

jenkins-script-security-plugin is vulnerabl to sandbox protection bypass during script compilation phase by applying AST transforming annotations...

Updated python-typed-ast packages fix security vulnerability

Updated python-typed-ast package fixes security vulnerabilities: typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but not necessarily execute it may be able to crash the interpreter process...

Shopify: xss on polaris.shopify.com/demo using postMessage

Description it's possible to run arbitrary js code using https://polaris.shopify.com/demo + postMessage following codes are from this file which formatted using prettier Demo component line 381 uses addEventListener to listen for message events line 401: js componentDidMount...

OPENSUSE-SU-2020:0609-1 Security update for python-typed-ast

This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563. This...

openSUSE Security Update : python-typed-ast (openSUSE-2020-567)

This update for python-typed-ast fixes the following issues : python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed : - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563. C...

Security update for python-typed-ast (low)

openSUSE Security Update: Security update for python-typed-ast Announcement ID: openSUSE-SU-2020:0609-1 Rating: low References: 1161562 1161563 1163532 Cross-References: CVE-2019-19274 CVE-2019-19275 Affected Products: openSUSE Backports SLE-15-SP1 An update that solves two vulnerabilities and ha...

openSUSE: Security Advisory for python-typed-ast (openSUSE-SU-2020:0567-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0567-1 Security update for python-typed-ast

This update for python-typed-ast fixes the following issues: python-typed-ast was reverted to version 1.3.1 because it broke another package bsc1163532. Security issues fixed: - CVE-2019-19274: Fixed an out-of-bounds read bsc1161562. - CVE-2019-19275: Fixed an out-of-bounds read bsc1161563...

Security update for python-typed-ast (low)

openSUSE Security Update: Security update for python-typed-ast Announcement ID: openSUSE-SU-2020:0567-1 Rating: low References: 1161562 1161563 1163532 Cross-References: CVE-2019-19274 CVE-2019-19275 Affected Products: openSUSE Leap 15.1 An update that solves two vulnerabilities and has one errat...

CVE-2019-1003005

A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code...

RHEL 7 : kernel (RHSA-2020:1266)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1266 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: heap overflow in mwifiexupdatevsie...

ast-cork.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1123481 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

ast-dez.kz Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1111437 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2020-2110

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...

Design/Logic Flaw

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations...