CVE-2023-49652

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb327fca3db11 and earlier allow attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate system-scoped credentials IDs of credentials stored in Jenkins and t...

CVE-2023-49652

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb327fca3db11 and earlier allow attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate system-scoped credentials IDs of credentials stored in Jenkins and t...

Design/Logic Flaw

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb327fca3db11 and earlier allow attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate system-scoped credentials IDs of credentials stored in Jenkins and t...

CVE-2023-49652

The CVE-2023-49652 entry concerns Jenkins Google Compute Engine Plugin (versions up to 4.550.vb_327fca_3db_11 and earlier). The underlying issue is incorrect permission checks that enable attackers with global Item/Configure permission (but without Item/Configure on any specific job) to enumerate...

CVE-2023-48305

CVE-2023-48305: Nextcloud Server and Nextcloud Enterprise Server logged user passwords in plaintext to log files when loglevel was set to debug in affected releases. Affected versions: Nextcloud Server/Enterprise Server up to 25.0.10.x, 25.0.12.x, 26.0.5.x, and 27.0.x (prior to patches). Root cau...

CVE-2023-48304

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0...

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-48304

CVE-2023-48304 affects Nextcloud Server (and Enterprise) where an attacker could enable/disable the birthday calendar for any user on the same server. Patches exist for Nextcloud Server versions 25.0.11, 26.0.6, and 27.1.0, and for Nextcloud Enterprise Server versions 22.2.10.16, 23.0.12.11, 24.0...

CVE-2023-48303 Nextcloud Server admins can change authentication details of user configured external storage

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage...

CVE-2023-48302 Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup Ctrl+Shift+V the...

CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-48239

Nextcloud Server vulnerable to an issue where a malicious user could update external storage, rendering it inaccessible for others. Affected: Nextcloud Server 25.0.0–25.0.12.x, 26.0.0–26.0.7.x, 27.0.x up to 27.1.2.x; Nextcloud Enterprise Server versions with corresponding prior branches. Patched ...

Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks

A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks. "Starting from a single compromised machine, threat actors could...

ServiceNow Widgets Data Exposure

ServiceNow is a popular cloud platform enabling developers to build custom applications around automation for their organizations. ServiceNow widgets are JavaScript based components used to define content of the portal pages and can be either builtin or customized by developers. Widgets access...

Cybersecurity at a Crossroads: New Implications on Business Risk

During our 2023 Qualys Security Conference QSC taking place in Orlando, Florida, November 6-9, 2023, I unveiled an exciting new milestone for the company – the release of our new Qualys Enterprise TruRisk Platform, marking a seismic shift for the future of Qualys as a leader in managing and...

PCI DSS 4.0: How to Ensure Full Compliance with New Requirements

The Payment Card Industry Data Security Standard PCI DSS is one of the oldest mainstream requirements for compliance, originating in 2004. The PCI Security Standards Council manages the standard to ensure security for the global payment system. It globally applies to all entities that store,...

USN-6446-2: Linux kernel vulnerabilities

Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service host system crash or...

Microsoft Azure Security Vulnerabilities

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure. An attacker can exploit the vulnerability to elevate privileges...

High-Severity Flaws in ConnectedIO's 3G/4G Routers Raise Concerns for IoT Security

Multiple high-severity security vulnerabilities have been disclosed in ConnectedIO's ER2000 edge routers and the cloud-based management platform that could be exploited by malicious actors to execute malicious code and access sensitive data. "An attacker could have leveraged these flaws to fully...

The vulnerability of Acronis Cloud Manager, a platform for managing hybrid clouds, stems from insufficient validation of input data, allowing attackers to execute arbitrary commands.

The vulnerability of Acronis Cloud Manager, a platform for managing hybrid clouds, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary commands...