CVE-2024-39544

CVE-2024-39544 concerns an issue in Juniper Networks Junos OS Evolved where NETCONF traceoptions files can be read due to incorrect default permissions in the CLI. The vulnerability affects Junos OS Evolved where NETCONF traceoptions are configured, enabling a low-privileged local user to access ...

CVE-2024-39544 Junos OS Evolved: Low privileged local user able to view NETCONF traceoptions files

An Incorrect Default Permissions vulnerability in the command line interface CLI of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information. On all Junos OS Evolved platforms, when NETCONF...

CVE-2024-39527

CVE-2024-39527 describes an exposure of sensitive information vulnerability in the CLI of Juniper Networks Junos OS on SRX Series devices. A local, low-privileged user with CLI access can view protected files on the file system through crafted CLI commands, enabling information disclosure as desc...

CVE-2024-39527 Junos OS: SRX Series: Low privileged user able to access sensitive information on file system

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface CLI of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of protected files on the file system. Through the...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 30, 2024 to October 6, 2024)

Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024: All in-scope vulnerability types for WordPress plugins/themes with = 1,000 active installations are...

Malicious code in cli-command-with-alias (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b03e8947704f3b685460bd5c1a963c852f7877815be28a52d9642875d1348d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-38817

VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root...

CVE-2024-38817

VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root...

Vulnerabilities fixed in Microsoft Azure components

Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges or execute code with administrator privileges. Azure Monitor: |----------------|------|-------------------------------------| | CVE ID | CVS...

Malicious code in msdhsfhjfj-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 932d9efe887d64209a4ce155d5f224a976b49eb001d725016073b83f2d8b3bcd The OpenSSF Package Analysis project identified 'msdhsfhjfj-cli' @ 9.4.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in protobufj-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ed062cce3f1c6c84bfdb6183ed9db3baafed65d7695929d1747b34a9dcdbba8 The OpenSSF Package Analysis project identified 'protobufj-cli' @ 9.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9102 Malicious code in protobufj-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ed062cce3f1c6c84bfdb6183ed9db3baafed65d7695929d1747b34a9dcdbba8 The OpenSSF Package Analysis project identified 'protobufj-cli' @ 9.1.1 npm as malicious. It is considered malicious because: - The package...

BIT-JENKINS-2024-47804

If an attempt is made to create an item of a type prohibited by ACLhasCreatePermission2 or TopLevelItemDescriptorisApplicableInItemGroup through the Jenkins CLI or the REST API and either of these checks fail, Jenkins LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk,...

Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin when accessing item config.xml via REST API...

GHSA-62JV-J4W7-5HH8 Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin when accessing item config.xml via REST API...

CVE-2024-20492 Cisco Expressway Series Privilege Escalation Vulnerability

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level...

CVE-2024-20432 Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability

A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller NDFC could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient...

CVE-2024-20432

Cisco Nexus Dashboard Fabric Controller (NDFC) is affected by CVE-2024-20432 via a REST API and web UI command-injection flaw caused by improper user authorization and insufficient validation of command arguments. A low-privilege, authenticated attacker could submit crafted commands to affected R...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...

CVE-2024-47805

Jenkins Credentials Plugin 1380.va435002fa924 and earlier, except 1371.1373.v4ebfab7161e9, does not redact encrypted values of credentials using the SecretBytes type when accessing item config.xml via REST API or CLI...