CVE-2023-28677

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

sharp vulnerable to Command Injection in post-installation over build environment

There's a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their...

GHSA-GP95-PPV5-3JC5 sharp vulnerable to Command Injection in post-installation over build environment

There's a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their...

Arbitrary Command Injection

sharp is vulnerable to arbitrary command injection. An attacker is able to set the value of the PKGCONFIGPATH environment variable in a build environment which allows arbitrary command injection at npm install time...

CVE-2022-29256 Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...

sharp 操作系统命令注入漏洞

sharp is a program by the individual developers at lovell for converting large images in common formats into smaller, web-friendly JPEG, PNG, WebP, GIF and AVIF images of different sizes. An operating system command injection vulnerability exists in versions prior to sharp 0.30.5. An attacker can...

PT-2022-19504 · Npm · Sharp

Name of the Vulnerable Software and Affected Versions: sharp versions prior to 0.30.5 Description: The issue is related to a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set th...

org.jenkins-ci.main:jenkins-test-harness (1.494), org.jenkins-ci.main:jenkins-war (1.494) +9 more potentially affected by CVE-2021-21690 via org.jenkins-ci.main:jenkins-core (1.494)

org.jenkins-ci.main:jenkins-core MAVEN version 1.494 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.494 - org.jenkins-ci.main:jenkins-war 1.494 -...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2021-21683 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2021-21640 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2021-21607 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

com.cloudbees.jenkins.plugins:cloudbees-registration (3.15), com.groupon.jenkins-ci.plugins:dotci (>=2.6.0, <=2.9.2) +16 more potentially affected by CVE-2020-2220 via org.jenkins-ci.main:jenkins-core (1.596)

org.jenkins-ci.main:jenkins-core MAVEN version 1.596 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:cloudbees-registration 3.15 - com.groupon.jenkins-ci.plugins:dotc...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2020-2161 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

Jenkins Build Environment Plugin vulnerable to Cross-site Scripting

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission. Jenkins...

GHSA-88QJ-3Q6H-8M5Q Jenkins Build Environment Plugin vulnerable to Cross-site Scripting

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission. Jenkins...

org.jenkins-ci.main:jenkins-test-harness (1.494), org.jenkins-ci.main:jenkins-war (1.494) +9 more potentially affected by CVE-2018-1999043 via org.jenkins-ci.main:jenkins-core (1.494)

org.jenkins-ci.main:jenkins-core MAVEN version 1.494 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.494 - org.jenkins-ci.main:jenkins-war 1.494 -...

com.cloudbees.jenkins.plugins:docker-custom-build-environment (>=1.2, <=1.5.1), com.cloudbees.jenkins.plugins:mansion-cloud (>=1.29, <=1.30) +64 more potentially affected by CVE-2019-1003050 via org.jenkins-ci.main:jenkins-core (1.580)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:docker-custom-build-environment =1.2, =1.29, =1.14.0-alpha-1,...

IoTGoat - A Deliberately Insecure Firmware Based On OpenWrt

The IoTGoat Project is a deliberately insecure firmware based on OpenWrt. The project’s goal is to teach users about the most common vulnerabilities typically found in IoT devices. The vulnerabilities will be based on the IoT Top 10 as documented by OWASP:...

CVE-2019-10395

Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties...