CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system...

CVE-2024-23897

CVE-2024-23897 affects Jenkins 2.441 and earlier, and LTS 2.426.2 and earlier. The root cause is an enabled args4j-based CLI feature (expandAtFiles) that replaces an @file path in CLI arguments with the file contents, enabling read access to arbitrary files on the Jenkins controller filesystem. P...

CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system...

PT-2024-1303 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.217 through 2.441 Jenkins LTS versions 2.222.1 through 2.426.2 Description: The issue is related to the built-in command line interface CLI of the Jenkins server, which has a weakness in its authentication procedure. This...

Jenkins LTS < 2.426.3 / Jenkins weekly < 2.442 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.426.3 or Jenkins weekly prior to 2.442. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disabl...

Jenkins cli Ampersand Replacement Arbitrary File Read

This module utilizes the Jenkins cli protocol to run the help command. The cli is accessible with read-only permissions by default, which are all thats required. Jenkins cli utilizes args4j's parseArgument, which calls expandAtFiles to replace any @ with the contents of a file. We are then able t...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.14.10 packages and security update

Red Hat OpenShift Container Platform release 4.14.10 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

lillinput (>=0.2.1, <=0.3.0), lillinput-cli (0.3.0) potentially affected by CVE-2024-58266 via shlex (1.1.0)

shlex CARGO version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on shlex and may be impacted: - lillinput =0.2.1, =0.3.0 - lillinput-cli 0.3.0 Source cves: CVE-2024-58266 Source advisory: OSV:GHSA-R7QV-8R2H-PG27...

Introducing Wordfence CLI 3.0.1: Now With Automatic Remediation!

Note: This post refers to Wordfence CLI, the command line tool for operations teams to rapidly scan large numbers of WordPress websites for vulnerabilities and malware, not the Wordfence plugin which is deeply integrated into WordPress and provides additional functionality, like a firewall,...

lillinput (>=0.2.1, <=0.3.0), lillinput-cli (0.3.0) potentially affected by CVE-2024-58266 via shlex (1.1.0)

shlex CARGO version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on shlex and may be impacted: - lillinput =0.2.1, =0.3.0 - lillinput-cli 0.3.0 Source cves: CVE-2024-58266 Source advisory: OSV:RUSTSEC-2024-0006...

GHSA-FRXM-V7Q3-V2WV Insertion of Sensitive Information into Log File in OWASP DependencyCheck

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

Insertion of Sensitive Information into Log File in OWASP DependencyCheck

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

CVE-2024-23686

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

Design/Logic Flaw

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

CVE-2024-23686 DependencyCheck Debug Mode Logging of NVD API Key

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

CVE-2024-23686 DependencyCheck Debug Mode Logging of NVD API Key

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

CVE-2024-23686

CVE-2024-23686 affects DependencyCheck components: Maven (9.0.0–9.0.6), CLI (9.0.0–9.0.5), and Ant (9.0.0–9.0.5). The root cause is that in debug mode, logging sensitive data exposes the NVD API Key via log files, enabling an attacker with log access to recover the key. Several connected sources ...

CVE-2023-48795 affecting package moby-cli for versions less than 20.10.27-2

CVE-2023-48795 affecting package moby-cli for versions less than 20.10.27-2. A patched version of the package is available...

[SECURITY] Fedora 38 Update: podman-4.8.3-1.fc38

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

DependencyCheck Log Information Disclosure Vulnerability

DependencyCheck is a software portfolio analysis SCA tool that attempts to detect publicly disclosed vulnerabilities contained in project dependencies. A security vulnerability exists in DependencyCheck. An attacker exploited the vulnerability to recover NVD API keys from log files. The following...