1232 matches found
CVE-2020-2257
Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2020-2159
Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins...
CVE-2019-19160
Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure filerxp...
CVE-2018-1999029
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that...
Malicious code in hardhat-configure (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77548f696a5d458d665f8134760c4dea58e0b1f7b66856ddc83a4c1096c4a0f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3892 Malicious code in hardhat-configure (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77548f696a5d458d665f8134760c4dea58e0b1f7b66856ddc83a4c1096c4a0f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
...
SUSE CVE-2022-49773
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix optc2configure warning on dcn314 Why dcn314 uses optc2configurecrc that wraps optc1configurecrc + set additional registers not applicable to dcn314. It's not critical but when used leads to warning like:...
DEBIAN-CVE-2022-49773
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix optc2configure warning on dcn314 Why dcn314 uses optc2configurecrc that wraps optc1configurecrc + set additional registers not applicable to dcn314. It's not critical but when used leads to warning like:...
UBUNTU-CVE-2022-49773
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix optc2configure warning on dcn314 Why dcn314 uses optc2configurecrc that wraps optc1configurecrc + set additional registers not applicable to dcn314. It's not critical but when used leads to warning like:...
CVE-2022-49773
CVE-2022-49773 affects the Linux kernel (drm/amd/display for DCN314). Root cause: optc2_configure_crc() wraps optc1_configure_crc() plus extra registers not applicable to dcN314, which can trigger a warning trace. Mitigation/Fix: use optc1_configure_crc() directly. References note patches in kern...
The vulnerability of the `s.contexts._.configure` function in the library for loading JavaScript modules via RequireJS allows a attacker to execute arbitrary code or cause a service failure.
The vulnerability of the s.contexts..configure function in the library for loading JavaScript modules using RequireJS is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service...
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
Jenkins Templating Engine Plugin allows defining libraries both in the global configuration, as well as scoped to folders containing the pipelines using them. While libraries in the global configuration can only be set up by administrators and can therefore be trusted, libraries defined in folder...
Privilege Context Switching Error
Overview Affected versions of this package are vulnerable to Privilege Context Switching Error due to the injectPrimitives function not taking sandbox protection into account for folder-scoped libraries. A user with Item/Configure permission can bypass the sandbox to execute code in the Jenkins...
GHSA-WR6W-JXG7-QPFH Jenkins Missing Permission Check
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration. This is due to an...
CVE-2025-31722
In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...
PT-2025-14511 · Jenkins +1 · Jenkins +1
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier Description: A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gainin...
PT-2025-27729
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the wled configure function. This issue arises because devm kasprintf returns NULL when memory...
SUSE CVE-2022-49462
In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Fix refcount leak in a6xxgpuinit ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. a6xxgmuinit passes the node to offinddevicebynode and...
lakeFS allows an authenticated user to cause a crash by exhausting server memory
Impact An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. Patches This problem has been patched and exists in versions 1.49.1 and below Workarounds On S3 backends, configure yaml ... blockstore: s3: disablepresignedmultipart: true...