CVE-2019-1003001

A flaw was found in Jenkins Pipeline. In the Declarative plugin, the script sandbox protection could be circumvented during the script compilation phase by applying AST. Both the pipeline validation REST APIs and the actual script/pipeline execution are affected. This allows users with Overall/Re...

CVE-2019-1003000

A flaw was found in Jenkins Pipeline. The Script Security sandbox protection could be circumvented during the script compilation phase by applying AST, transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are...

Sandbox Bypass in Script Security and Pipeline Plugins

Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Re...

UBUNTU-CVE-2018-19838

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENTASTOPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone, cloneChildren, and copy...

LibSass Denial of Service Vulnerability (CNVD-2019-06789)

LibSass is an open source written in C using Sass CSS extension language parser . A security vulnerability exists in several functions of the ast.cpp file in LibSass versions prior to 3.5.5. An attacker can exploit this vulnerability to cause a denial of service stack corruption with the help of ...

CVE-2018-15857

The CVE-2018-15857 entry describes an invalid free in xkbcomp/ast-build.c (ExprAppendMultiKeysymList) in libxkbcommon prior to 0.8.1 that could allow a local attacker to crash the xkbcommon keymap parsers or possibly have unspecified impact by supplying a crafted keymap file. The issue is caused ...

CVE-2018-15857

An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file...

Asterisk 13.x < 13.21.1 / 14.x < 14.7.7 / 13.13 < 13.18-cert4 / 13.21 < 13.21-cert2 Information Disclosure Vulnerability (AST-2018-008)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.21.1, 14.x prior to 14.7.7, or 13.18 prior to 13.18-cert4. It is therefore, affected by a remote denial of service attack as described in AST-2018-008. Note that Nessus has not tested for these...

ast-portal.ttpsc.net XSS vulnerability

Open Bug Bounty ID: OBB-632543 Description| Value ---|--- Affected Website:| ast-portal.ttpsc.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework. Authors Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes Research Blog Post: https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html White Paper:...

FreeBSD : asterisk and pjsip -- multiple vulnerabilities (f9f5c5a2-17b5-11e8-90b8-001999f8d30b)

The Asterisk project reports : AST-2018-002 - By crafting an SDP message with an invalid media format description Asterisk crashes when using the pjsip channel driver because pjproject's sdp parsing algorithm fails to catch the invalid media format description. AST-2018-003 - By crafting an SDP...

Artifex MuJS Denial of Service Vulnerability

Artifex MuJS is a lightweight JavaScript interpreter from Artifex Software, which is used to embed into other software to provide script execution. A security vulnerability exists in the jsparse.c file in Artifex MuJS 1.0.2 and earlier versions, which stems from the program failing to properly...

Design/Logic Flaw

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service excessive recursion via a crafted file...

CVE-2018-5759

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service excessive recursion via a crafted file...

CVE-2018-5759

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service excessive recursion via a crafted file...

CVE-2018-5759

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service excessive recursion via a crafted file...

CVE-2018-5759

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service excessive recursion via a crafted file...

Fedora 27 : asterisk (2017-41242dfe10)

Update to upstream 14.7.5 release for AST-2017-014/CVE-2017-17850 security issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Asterisk 13.x < 13.18.3 / 14.x < 14.7.3 / 15.x < 15.1.3 / 13.13 < 13.13-cert8 Memory Exhaustion Remote DoS (AST-2017-013)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.18.3, 14.x prior to 14.7.3, 15.x prior to 15.1.3, or 13.13 prior to 13.13-cert8. It is therefore, affected by a memory exhaustion remote denial-of-service attack as described in AST-2017-013. Also...

Asterisk 13.x < 13.18.1 / 14.x < 14.7.1 / 15.x < 15.1.1 / 13.13 < 13.13-cert7 Multiple Vulnerabilities (AST-2017-009 - AST-2017-011)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.18.1, 14.x prior to 14.7.1, 15.x prior to 15.1.1, or 13.13 prior to 13.13-cert7. It is therefore, affected by multiple vulnerabilities as described in AST-2017-009, AST-2017-010, and AST-2017-011...