1347 matches found
CVE-2021-21619
Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...
CVE-2021-21619
The CVE-2021-21619 issue affects Jenkins Claim Plugin (version ≤ 2.18.1). A stored XSS vulnerability arises because the plugin does not escape the user display name, allowing an attacker who can set a user’s display name (via the security realm or within Jenkins) to inject/script content. The vul...
PT-2021-14663 · Jenkins · Jenkins Claim Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Claim Plugin versions 2.18.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to change claims. This issue arises because the form submission endpoint for assigning claims does not require POST...
Jenkins Claim Plugin 跨站脚本漏洞
Jenkins Claim is an open source application plugin for Jenkins. Provides users to declare failed builds and tests from Jenkins to show that they are responsible for fixing them . A cross-site script execution vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerabili...
Jenkins Claim 跨站请求伪造漏洞
Jenkins Claim is a Jenkins open source application plug-in . A cross-site request forgery vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerability stems from the program not making a POST request to the form submission endpoint of the assigned claim. An attacker...
GHSA-4FJV-PMHG-3RFG Multiple cryptographic issues in Python oic
Impact Client implementations using this library Issues 1 The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2 JWA none algorithm was allowed in all flows. 3 oic.consumer.Consumer.parseauthz returns an unverified IdToken. Th...
Multiple cryptographic issues in Python oic
Impact Client implementations using this library Issues 1 The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2 JWA none algorithm was allowed in all flows. 3 oic.consumer.Consumer.parseauthz returns an unverified IdToken. Th...
Cipher Downgrade Attack
oic is vulnerable to cipher downgrade attacks. The vulnerability exists as the IdToken signature algorithm is not checked automatically, and that the JWA none algorithm is always allowed, and that the IdToken returned from oic.consumer.Consumer.parseauthz is not verified, and the iat claim is not...
Design/Logic Flaw
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1 The IdToken signature algorithm was not checked automatically, but only if the expected...
PYSEC-2020-69
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1 The IdToken signature algorithm was not checked automatically, but only if the expected...
Attacks on industrial enterprises using RMS and TeamViewer: new data
Download full report PDF Executive Summary In summer 2019, Kaspersky ICS CERT identified a new wave of phishing emails containing various malicious attachments. The emails target companies and organizations from different sectors of the economy that are associated with industrial production in on...
Donald Trump Hasn't ‘Already Won’ the Election
Despite the president’s claims of victory, his reelection bid depends on a huge number of votes that have yet to be counted...
PT-2020-16538 · Lightning Network · Lnd
Name of the Vulnerable Software and Affected Versions: LND Lightning Network Daemon versions prior to 0.11.0-beta Description: The issue concerns a problem in the invoice database where LND failed to verify the settlement of an outgoing off-chain HTLC before releasing the preimage while claiming ...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
CVE-2020-16198
When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...
CVE-2020-25735
webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/addannouncement.php, administration/departments.php, administration/locations.php, expenses/claimtype.php, projects/editproject.php, and general/newnotifications.php...
statement-of-claim-against-estate.com Cross Site Scripting vulnerability OBB-1314369
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
I Did Not Write This Book
--- Fake Book Someone published a "book" on Amazon and claimed that I wrote it! I had NOTHING to do with this. I am working with Amazon now to remove it, or at least remove my name. Stay away from this garbage! Update: Thankfully, within a day or so of this post, the true author of this work...
Mail.ru: Subdomain Takeover at blog.instamart.ru
It was possible to claim unused instamart.ru subdomain delegated to external cloud service...
November 11, 2014 update for SharePoint Server 2013 (KB2883055)
November 11, 2014 update for SharePoint Server 2013 KB2883055 This article describes update KB2883055 for Microsoft SharePoint Server 2013 that was released on November 11, 2014. This update has a prerequisite. Fixes and Improvements Fixes the following issue: Assume that you open an Excel workbo...