CVE-2022-36917

CVE-2022-36917 affects Jenkins Google Cloud Backup Plugin 0.6 and earlier, where a missing permission check in an HTTP endpoint allows attackers with Overall/Read to request a manual backup. The issue can enable CSRF exposure due to non-POST endpoint usage and, per PT-security notes, may enable c...

CVE-2022-36917

A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup...

CVE-2022-36916

A cross-site request forgery CSRF vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup...

CVE-2022-36916

CVE-2022-36916 is a CSRF vulnerability in Jenkins Google Cloud Backup Plugin versions 0.6 and earlier. The issue stems from a missing permission check in an HTTP endpoint, which also does not require POST requests, enabling an attacker to trigger a manual backup. The NVD entry assigns a high impa...

CVE-2022-36916

A cross-site request forgery CSRF vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup...

Jenkins Google Cloud Backup Plugin security vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2022-4013 · Jenkins · Jenkins Google Cloud Backup Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Cloud Backup Plugin versions 0.6 and earlier Description: A missing permission check in the Jenkins Google Cloud Backup Plugin allows attackers with Overall/Read permission to request a manual backup. This issue is related to...

CVE-2022-36917: Missing Authorization

A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup...

CVE-2022-36916: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup...

Jenkins Google Cloud Backup Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site request...

PT-2022-4010 · Jenkins · Jenkins Google Cloud Backup Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Cloud Backup Plugin versions 0.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to request a manual backup. This issue is related to the lack of a permission check in an HTTP endpoint,...

CSRF vulnerability and missing permission check in google-cloud-backup

google-cloud-backup 0.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to request a manual backup. Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery CSRF vulnerability...

Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

The plugin exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and...

Inductive Automation Ignition code issue vulnerabilities

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA Data Acquisition and Monitoring Systems, HMI Human Machine Interface and more. A code issue vulnerability exists in Inductive Automation Ignition...

CVE-2022-29964: Use of Hard-coded Credentials

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350...

Release Information for Veeam Plug-In for Microsoft Azure v4

Requirements Please confirm that you are running Veeam Plug-In for Microsoft Azure v3 build 3.0.0.666 or later before upgrading. The currently installed build number Server Version is in the About section under Configuration | Support Information. After installing Veeam Plug-In for Microsoft Azur...

Inductive Automation Ignition

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Inductive Automation Equipment: Ignition Vulnerability: Improper Restriction of XML External Entity Reference 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...

WP-DBManager < 2.80.8 - Admin+ Remote Command Execution

The plugin does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should. Use any WordPress plugin that allows the users to upload files with extension - ".php" is not required - for example: .jpg usually many...

FUJITSU ETERNUS CS8000 requestTempFile Command Execution

The vulnerability of the requestTempFile function in the web interface of the unified console consolidation platform for backup and archiving FUJITSU ETERNUS CS8000 relates to the possibility of executing commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

FUJITSU ETERNUS CS8000 requestTempFile Command Execution

The vulnerability of the requestTempFile function in the web interface of the unified console consolidation platform for backup and archiving FUJITSU ETERNUS CS8000 relates to the possibility of executing commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary comman...