7341 matches found
CVE-2023-3971
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...
com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.0.9, <=4.1.0), org.jenkins-ci.lib:xtrigger-lib (0.36) +5 more potentially affected by CVE-2023-39151 via org.jenkins-ci.main:jenkins-core (1.644)
org.jenkins-ci.main:jenkins-core MAVEN version 1.644 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.elasticbox.jenkins-ci.plugins:elasticbox =4.0.9, =4.0.4, =1.0.45, =1.0.47 Source cves:...
CVE-2023-39154
CVE-2023-39154 affects Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier. The issue is incorrect permission checks in several HTTP endpoints, enabling attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs...
CVE-2023-39154
Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored i...
CVE-2023-39154
Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored i...
CSRF vulnerability and missing permission check in servicenow-devops allow capturing credentials
servicenow-devops 1.38.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...
Incorrect permission checks in qualys-was allow capturing credentials
qualys-was 2.0.10 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...
PT-2023-26811 · Jenkins · Jenkins Qualys Web App Scanning Connector Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Qualys Web App Scanning Connector Plugin versions 2.0.10 and earlier Description: The issue arises from incorrect permission checks in the Jenkins Qualys Web App Scanning Connector Plugin, allowing attackers with global Item/Configure...
REDCap SQL injection vulnerability
REDCap is a data collection and management web application. A security vulnerability exists in REDCap version 12.0.26 LTS and version 12.3.2 Standard, which stems from a SQL injection vulnerability at multiple function points...
U.S. Dept Of Defense: Blind Sql Injection in https://█████/qsSearch.aspx
A blind SQL injection vulnerability was discovered in the qsSearch.aspx page of the application. An attacker could exploit this vulnerability to bypass authentication and retrieve sensitive information from the database. The vulnerability has been mitigated by implementing appropriate security...
Denial Of Service (DoS)
wireshark is vulnerable to Denial Of Service DoS. A dissector crash within certain versions of wireshark which could lead to denial of service conditions through an injection or a crafted capture file...
Denial Of Service (DoS)
wireshark is vulnerable to Denial Of Service DoS. A crash in the GQUIC dissector may result in denial of service conditions, via a packet injection or a crafted capture file...
CVE-2023-32262: Undefined Security Weakness
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. See the following Jenkins security advisory for details:...
Owner of BreachForums Pleads Guilty to Cybercrime and Child Pornography Charges
Conor Brian Fitzpatrick, the owner of the now-defunct BreachForums website, has pleaded guilty to charges related to his operation of the cybercrime forum as well as having child pornography images. The development, first reported by DataBreaches.net last week, comes nearly four months after...
U.S. Dept Of Defense: SqlInject at ██████
Vulnerability description not provided...
SUSE CVE-2023-3649
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file...
SUSE CVE-2023-3648
Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file...
CVE-2023-3648
Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file...
