Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

RHEL 8 : flatpak-builder (RHSA-2022:7458)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7458 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak: flatpak-builder --mirror-screenshots-url can access files...

ALSA-2022:7548 Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

WordPress Bricks Builder premium theme <= 1.5.3 - Auth. Arbitrary Post/Page Edition vulnerability

Auth. Arbitrary Post/Page Edition vulnerability discovered by RG in WordPress Bricks Builder premium theme versions = 1.5.3. Solution Update the WordPress Bricks Builder theme to the latest available version at least 1.5.4...

WordPress Bricks Builder premium theme <= 1.5.3 - Auth. Remote Code Execution vulnerability

Auth. Remote Code Execution vulnerability discovered by RG in WordPress Bricks Builder premium theme versions = 1.5.3. Solution Update the WordPress Bricks Builder theme to the latest available version at least 1.5.4...

CVE-2022-40963

Multiple Auth. author+ Stored Cross-Site Scripting XSS vulnerabilities in WP Page Builder plugin = 1.2.6 on WordPress...

WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. Stored Cross-Site Scripting XSS vulnerabilities were discovered by Ngo Van Thien Patchstack Alliance in the WordPress WP Page Builder plugin versions = 1.2.6. Solution Update the WordPress WP Page Builder plugin to the latest available version at least 1.2.7...

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system allows a hacker to perform cross-site scripting attacks.

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system exists because measures are not taken to protect the structure of web pages when processing the “caption” parameter for uploaded files. Exploiting this vulnerability...

WP Page Builder < 1.2.7 - Author+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks...

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system allows a hacker to perform cross-site scripting attacks.

The vulnerability of the “Media App” module implementation in the Beaver Builder plugin of the WordPress content management system exists because measures are not taken to protect the structure of web pages when processing Image URLs. Exploiting this vulnerability allows a malicious actor to...

The vulnerability of the Beaver Builder plugin of the WordPress content management system, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Beaver Builder plugin of the WordPress content management system exists due to the lack of protection for website structures when images with the “Caption – On Hover” property are used. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

The vulnerability of the “Text Editor” module of the Beaver Builder plugin in the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the “Text Editor” module of the Beaver Builder plugin for WordPress content management systems exists due to the lack of protective measures for website page structures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

GHSA-PX4X-HJM5-W8X3 Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. XFramium Builder Plugin 1.0.22 and earlier globally disables the...

Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. XFramium Builder Plugin 1.0.22 and earlier globally disables the...

CVE-2022-43432

Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...

Design/Logic Flaw

Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...

CVE-2022-43432

Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...

Jenkins XFramium Builder Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-43432

Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...

PT-2022-26916 · Jenkins · Jenkins Xframium Builder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins XFramium Builder Plugin versions 1.0.22 and earlier Description: The issue allows cross-site scripting XSS attacks by users with the ability to control files in workspaces, archived artifacts, etc. This is because the Jenkins XFramium...