DEBIAN-CVE-2019-25032

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regionalalloc. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited...

Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"

Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...

Authentication Bypass

microsoft.bot.connector is vulnerable to authentication bypass. An attacker is able to bypass authentication using a malicious claim that is incorrectly authenticated by the bot. The vulnerability affects bots that are not configured to be used as a Skill and requires an an attacker to have...

Improper Authentication

Overview In affected versions of botframework-connector, a maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Recommendation Upgrade to fi...

Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

GHSA-QXX8-292G-2W66 Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

CloudBees Jenkins Claim Plugin Cross-Site Scripting Vulnerability

Jenkins Claim is an open source application plugin for Jenkins. Provides users to declare failed builds and tests from Jenkins to show that they are responsible for fixing them . A cross-site script execution vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerabili...

CloudBees Jenkins Claim Plugin Cross-Site Request Forgery Vulnerability

Jenkins Claim is a Jenkins open source application plug-in . A cross-site request forgery vulnerability exists in Jenkins Claim Plugin version 2.18.1 and earlier. The vulnerability stems from the program not making a POST request to the form submission endpoint of the assigned claim. An attacker...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

Cross site scripting

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21620

A cross-site request forgery CSRF vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims...

CVE-2021-21620

CVE-2021-21620 : Jenkins Claim Plugin 2.18.1 and earlier is vulnerable to cross-site request forgery (CSRF), allowing attackers to change claims. The issue stems from the affected endpoint not requiring proper request authentication/POST handling (per sources), enabling unauthorized claim modific...

CVE-2021-21619

The CVE-2021-21619 issue affects Jenkins Claim Plugin (version ≤ 2.18.1). A stored XSS vulnerability arises because the plugin does not escape the user display name, allowing an attacker who can set a user’s display name (via the security realm or within Jenkins) to inject/script content. The vul...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...