7341 matches found
CVE-2023-37943
Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted, allowing attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Activ...
Jenkins Plugin Datadog Security Vulnerabilities
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Jenkins Plugin Orka by MacStadium has security vulnerabilities
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Wireshark 4.0.x < 4.0.7 Multiple Vulnerabilities
The version of Wireshark installed on the remote Windows host is prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.0.7 advisory. - iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted captu...
Missing permission check in datadog allows capturing credentials
datadog 5.4.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. datadog...
Missing permission check in macstadium-orka allows capturing credentials
macstadium-orka 1.33 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
CSRF vulnerability and missing permission checks in mabl-integration allow capturing credentials
mabl-integration 0.0.46 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...
PT-2023-26201 · Jenkins · Jenkins Mabl Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins mabl Plugin versions 0.0.46 and earlier Description: A missing permission check in the Jenkins mabl Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs...
CVE-2023-37957: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token...
PT-2023-26213
Name of the Vulnerable Software and Affected Versions Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored...
PT-2023-26214
Name of the Vulnerable Software and Affected Versions Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs,...
Siemens SIMATIC MV500 Devices Uncontrolled Resource Consumption Vulnerability
SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of servic...
Wireshark 4.0.x < 4.0.7 Multiple Vulnerabilities (macOS)
The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.0.7 advisory. - iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or...
Siemens SIMATIC security vulnerabilities
SIMATIC MV500 products are fixed optical readers for capturing print, laser, drill, punch and dotted line codes on a variety of different surfaces. Siemens SIMATIC MV500 Devices has an uncontrolled resource consumption vulnerability that can be exploited by attackers to cause a denial of service...
Ethernet FX3U ENET Module Security Bypass Reset
The vulnerability of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET-L of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, stems from the ability to bypass authentication by using capture-replay techniques...
PT-2023-5382 · D Link · D-Link Dwl-6610Ap
Name of the Vulnerable Software and Affected Versions: D-LINK DWL-6610AP version FW v 4.3.0.8B003C Description: A command injection issue was found in the pcap download handler function, allowing attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter...
CVE-2023-1691
Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally...
CVE-2022-48507: Authentication Bypass by Capture-replay
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2023-35149
A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...