Stored XSS vulnerability in multiple axis builds tooltips in matrix-project

matrix-project 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes. This results in a stored cross-site scripting XSS vulnerability exploitable by users with Job/Configure permission. matrix-project 1.17 escapes the axis names shown ...

CVE-2020-2225: Improper Neutralization of Input During Web Page Generation

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability...

June 2, 2020, update for Office 2016 (KB4484171)

None None...

QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability

QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from cross site request forgery and weak access control vulnerabilities. ------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice...

QRadar Community Edition 7.3.1.6 CSRF / Weak Access Control

------------------------------------------------------------------------ Cross-Site Request Forgery & weak access control in QRadar ConfigServices webservice ------------------------------------------------------------------------ Yorick Koster, September 2019...

CloudBees Jenkins Yaml Axis Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Yaml Axis Plugin is used in one of the axis creation and...

CVE-2020-2179

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2179

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2179

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2179

Jenkins Yaml Axis Plugin (versions ≤0.2.0) is affected by a remote code execution vulnerability due to the YAML parser not restricting deserialized types. Exploitation is possible when a user can configure a multi-configuration (Matrix) job or control contents of a job’s SCM repository. The issue...

CVE-2020-2179

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

PT-2020-15392 · Jenkins · Jenkins Yaml Axis Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Yaml Axis Plugin versions 0.2.0 and earlier Description: The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This vulnerability...

RCE vulnerability in yaml-axis

yaml-axis 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to configure a multi-configuration Matrix job, or control the contents of a previously configured job...

CVE-2020-2179: Deserialization of Untrusted Data

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Oracle Application Testing Suite (Apr 2020 CPU)

The version of Oracle Application Testing Suite installed on the remote host is affected by a Server Side Request Forgery SSRF vulnerability in the Oracle FLEXCUBE Private Banking product of Oracle Financial Services Applications component: Core Apache Axis. The supported versions which are...

Security Bulletin: Multiple Security Vulnerabilities in Apache Axis Affect IBM Sterling B2B Integrator (CVE-2014-3596, CVE-2012-5784)

Summary IBM Sterling B2B Integrator uses ActiveMQ. ActiveMQ uses Axis and is vulnerable. Vulnerability Details CVEID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the serve...

Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by...

Oracle Tuxedo Remote Code Execution Vulnerability (Jan 2020 CPU)

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by a remote code execution vulnerability due to a Server Side Request Forgery SSRF vulnerability found in the Apache Axis 1.4 distribution used in the TX SALT component. %NASLMINLEVEL...