11561 matches found
GHSA-RC2Q-X9MF-W3VF TestNG is vulnerable to Path Traversal
Impact Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal only for .xml, .yaml and .yml files by default. The attack implies running an...
Exploit for Improper Input Validation in Imagemagick
Container Escape Exploit This is a container escape exploit t...
What’s New for Developers: November 2022
Read about the EdgeGrid PHP client update, EdgeWorkers news, the Terraform Provider 3.0 release, and the new Build, Deliver & Secure video series...
firejail
This repository is an open-source project for the Firejail tool, which is a Linux security tool that allows users to sandbox applications and restrict their access to system resources. The repository contains various files and directories related to the project, including configuration files,...
PT-2022-27522 · Acronis · Acronis Agent +2
Name of the Vulnerable Software and Affected Versions: Acronis Agent Windows versions before build 29633 Acronis Cyber Protect 15 Windows versions before build 30984 Description: The issue is related to sensitive information disclosure and manipulation due to improper certification validation...
PT-2022-27521 · Acronis · Acronis Cyber Protect Home Office +3
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Home Office versions prior to build 40107 Acronis Agent versions prior to build 30025 Acronis Cyber Protect 15 versions prior to build 30984 Description: The issue is related to local privilege escalation due to incomple...
PT-2022-27517 · Acronis · Acronis Agent +2
Name of the Vulnerable Software and Affected Versions: Acronis Agent versions before build 28610 Acronis Cyber Protect 15 versions before build 30984 Description: The issue is related to sensitive information disclosure and manipulation due to improper authorization. Recommendations: For Acronis...
PT-2022-27524 · Acronis · Acronis Agent +2
Name of the Vulnerable Software and Affected Versions: Acronis Agent Windows versions before build 30025 Acronis Cyber Protect 15 Windows versions before build 30984 Description: The issue is related to sensitive information disclosure due to insecure registry permissions. Recommendations: For...
GHSA-V535-PC6R-77QH Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin
CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt. In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authenticatio...
XXE vulnerability on agents in Jenkins SourceMonitor Plugin
SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities...
GHSA-J874-47XX-9XFG Missing permission check in Jenkins Delete log Plugin
A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. As of publication of this advisory, there is no fix...
GHSA-HW4F-G7WH-XP52 Cross-Site Request Forgery in Jenkins Delete log Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...
Cross-Site Request Forgery in Jenkins Delete log Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...
GHSA-J923-26C2-QQ9P Jenkins BART Plugin vulnerable to cross-site scripting (XSS)
Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability. Currently, there are no known workarounds or patches available...
Cross-site Scripting in Jenkins Naginator Plugin
Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to edit build display names. Naginator Plugin 1.18.2 escapes display nam...
GHSA-H8HF-HXX6-5G6V Cross-site Scripting in Jenkins Naginator Plugin
Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to edit build display names. Naginator Plugin 1.18.2 escapes display nam...
PT-2022-7422 · Acronis · Acronis Cyber Protect 15 +1
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions prior to build 30984 Description: The issue is related to excessive privileges assigned to Acronis Agent, leading to sensitive information disclosure. This could allow a remote attacker to gain unauthorized...
Malicious code in internal-lib-build (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b271298f1e935433f4b43cdb97a3b1f713540d0c503abc6bab0050507a1ad5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
