CVE-2023-37963

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37962

CVE-2023-37962 concerns Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier. A CSRF flaw arises because a form-validation method lacks a permission check and does not require POST, enabling attackers with Overall/Read permission to trigger connections to attacker-specified URLs and to p...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37963: Missing Authorization

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37962: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

Jenkins Plugin Benchmark Evaluator Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin Benchmark Evaluator security vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-26211 · Jenkins · Jenkins Benchmark Evaluator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb...

CSRF vulnerability and missing permission checks in benchmark-evaluator

benchmark-evaluator 1.0.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins...

CVE-2023-32114

SAP NetWeaver Change and Transport System - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact ...

CVE-2023-32114

SAP NetWeaver Change and Transport System - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact ...

Design/Logic Flaw

SAP NetWeaver Change and Transport System - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact ...

CVE-2023-32114

CVE-2023-32114 affects SAP NetWeaver Change and Transport System (CTS) for versions 702–757. An authenticated user with admin privileges can repeatedly run a benchmark program, causing resource exhaustion and a denial of service with limited impact on availability; confidentiality and integrity a...

CVE-2023-32114: Incorrect Permission Assignment for Critical Resource

SAP NetWeaver Change and Transport System - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact ...

PT-2023-3748 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Change and Transport System versions 702 through 757 Description: The issue is related to a lack of resource control mechanism in the Change and Transport System component of SAP NetWeaver. This allows an authenticated user with...

cn.jrack:jrack-metadata-clickhouse (>=1.0.0, <=1.0.10), cn.jrack:jrack-test (>=1.0.0, <=1.0.10) +47 more potentially affected by CVE-2024-23689 via com.clickhouse:clickhouse-client (>=0.3.2, <=0.4.5)

com.clickhouse:clickhouse-client MAVEN version =0.3.2, =1.0.0, =1.0.0, =0.2.6, =2.10.6.9, =0.3.2, =0.3.2-patch11, =0.3.2, =0.3.2, =0.3.2, =0.3.2, =0.298, =2.0.0, =2.0.2 and more Source cves: CVE-2024-23689 Source advisory: OSV:GHSA-G8PH-74M6-8M7R...

com.lightbend.lagom:lagom-javadsl-integration-client_2.12 (>=1.6.0-m5, <=1.6.0-m6), com.lightbend.lagom:lagom-javadsl-kafka-broker_2.12 (>=1.6.0-m5, <=1.6.0-m6) +15 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.12 (1.0.5)

com.typesafe.akka:akka-stream-kafka2.12 MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-stream-kafka2.12 and may be impacted: - com.lightbend.lagom:lagom-javadsl-integration-client2.12 =1.6.0-m5, =1.6.0-m5,...

auditpolCIS - CIS Benchmark Testing Of Windows SIEM Configuration

CIS Benchmark testing of Windows SIEM configuration This is an application for testing the configuration of Windows Audit Policy settings against the CIS Benchmark recommended settings. A few points: The tested system was Windows Server 2019, and the benchmark used was also Windows Server 2019. T...