GHSA-4FFQ-6G62-J4V4 Cross-Site Request Forgery in the Jenkins Claim plugin

Jenkins Claim Plugin 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to change claims. Jenkins Claim Plugin 2.18.2 requires POST requests for the...

Cross-Site Request Forgery in the Jenkins Claim plugin

Jenkins Claim Plugin 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to change claims. Jenkins Claim Plugin 2.18.2 requires POST requests for the...

NFTXLPStaking Is Subject To A Flash Loan Attack That Can Steal Nearly All Rewards/Fees That Have Accrued For A Particular Vault

Handle jvaqa Vulnerability details NFTXLPStaking Is Subject To A Flash Loan Attack That Can Steal Nearly All Rewards/Fees That Have Accrued For A Particular Vault Impact The LPStaking contract does not require that a stake be locked for any period of time. The LPStaking contract also does not tra...

Vault rewards last claim time not always initialized

Handle @cmichelio Vulnerability details Vulnerability Details The harvest calls calcCurrentReward which computes secondsSinceClaim = block.timestamp - mapMemberSynthlastTimemembersynth;. As one can claim different synths than the synths that they deposited, mapMemberSynthlastTimemembersynth might...

DEBIAN-CVE-2019-25032

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regionalalloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"

Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...

Authentication Bypass

microsoft.bot.connector is vulnerable to authentication bypass. An attacker is able to bypass authentication using a malicious claim that is incorrectly authenticated by the bot. The vulnerability affects bots that are not configured to be used as a Skill and requires an an attacker to have...

Improper Authentication

Overview In affected versions of botframework-connector, a maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Recommendation Upgrade to fi...

GHSA-QXX8-292G-2W66 Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

CloudBees Jenkins Claim Plugin Cross-Site Request Forgery Vulnerability

Jenkins Claim is a Jenkins open source application plug-in . A cross-site request forgery vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerability stems from the program not making a POST request to the form submission endpoint of the assigned claim. An attacker...

CloudBees Jenkins Claim Plugin Cross-Site Scripting Vulnerability

Jenkins Claim is an open source application plugin for Jenkins. Provides users to declare failed builds and tests from Jenkins to show that they are responsible for fixing them . A cross-site script execution vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerabili...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

Cross site scripting

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21620

CVE-2021-21620 : Jenkins Claim Plugin 2.18.1 and earlier is vulnerable to cross-site request forgery (CSRF), allowing attackers to change claims. The issue stems from the affected endpoint not requiring proper request authentication/POST handling (per sources), enabling unauthorized claim modific...