PT-2018-9398

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeBuild Plugin versions 0.26 and earlier Description The issue is related to insufficiently protected credentials in the AWSClientFactory.java and CodeBuilder.java files, which can lead to credentials disclosure. This can be...

PT-2018-9395

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodePipeline Plugin versions 0.36 and earlier Description The issue is related to insufficiently protected credentials in the AWSCodePipelineSCM.java file, which can lead to credentials disclosure. This can be exploited via local...

PT-2018-9397

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeDeploy Plugin versions 1.19 and earlier Description The issue is related to insufficiently protected credentials in the Jenkins AWS CodeDeploy Plugin, specifically in the AWSCodeDeployPublisher.java file, which can lead to...

Critical Photon OS Security Update - PHSA-2018-0068

Updates of 'linux-aws', 'linux-secure', 'linux-esx', 'linux', 'curl' packages of Photon OS have been released...

Insufficiently Protected Credentials

The Jenkins AWS CodePipeline Plugin contains an Insufficiently Protected Credentials vulnerability...

PT-2018-9396

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeDeploy Plugin versions 1.19 and earlier Description The issue is related to a File and Directory Information Exposure that can result in the disclosure of environment variables. This is due to a vulnerability in the...

Ubuntu: Security Advisory (USN-3695-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Release Notes for Veeam Backup & Replication 9.5 Update 3a

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Release Notes for Veeam Backup Replication 9.5 Update 3a Cause Please confirm that you are running version 9.5.0.580, 9.5.0.711, 9.5.0.802, 9.5.0.823,...

CVE-2018-5436

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Softwa...

Information disclosure

The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contain multiple...

Design/Logic Flaw

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Softwa...

CVE-2018-5436

CVE-2018-5436 affects TIBCO Spotfire Platform for AWS Marketplace (up to 7.12.0) and TIBCO Spotfire Server (up to 7.8.1; 7.9.0; 7.10.0; 7.11.0; 7.12.0). The vulnerabilities may disclose information, including user and data source credentials. CVSSv3 base score 8.8 (HIGH) with NETWORK attack vecto...

CVE-2018-5436 TIBCO Spotfire Server information disclosure vulnerabilities

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Softwa...

CVE-2018-5436: Exposure of Sensitive Information to an Unauthorized Actor

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Softwa...

See how I dig in and successfully exploited India's Popular Sports company web site Host header SQL injection vulnerability-vulnerability warning-the black bar safety net

Today I want to share one I'm doing bugbounty project, discovered a very interesting vulnerability, and this vulnerability appeared in India, a popular sports company website. This article is about“how do I use the host header to find out theSQL injectionvulnerabilities, and the use of sqlmap...

AWS CodePipeline Plugin stored AWS Secret Key in plain text

AWS CodePipeline Plugin stored the AWS Secret Key in its configuration unencrypted in jobs' config.xml files on the Jenkins controller. This key could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked from view using a password form...

IBM z/OS Connector Plugin stores password in plain text

IBM z/OS Connector Plugin did not encrypt password credentials stored in its configuration. This could be used by users with Jenkins controller file system access to obtain the password. While masked from view using a password form field, the AWS Secret Key was transferred in plain text to...

Important Photon OS Security Update - PHSA-2018-0062

Updates of 'linux', 'linux-esx', 'linux-aws', 'linux-secure' packages of Photon OS have been released...

Moderate: Red Hat Security Advisory: ansible security and bug fix update

An update for ansible is now available for Red Hat Ansible Engine 2 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

22K Open, Vulnerable Containers Found Exposed on the Net

More than 22,000 container orchestration and API management systems are unprotected or publicly available on the internet – highlighting the reality of the risks of operating workloads in the cloud. According to research from Lacework, the containers Kubernetes, Mesos, Docker Swarms and more suff...