CVE-2025-25286

CVE-2025-25286 affects Crayfish’s Homarus FFmpeg microservice. Prior to Crayfish 4.1.0, remote code execution could occur in web-accessible installations in certain configurations. The issue has been patched in islandora/crayfish:4.1.0. Workarounds include preventing Internet access to Homarus or...

PT-2025-11020

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.13.0 Description: A use-after-free issue has been identified in the Linux kernel, specifically in the geneve find dev function. This issue occurs when the geneve configure function links the struct geneve...

CVE-2024-27192

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scott Reilly Configure SMTP allows Reflected XSS.This issue affects Configure SMTP: from n/a through 3.1...

CVE-2025-24397

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins...

CVE-2025-24397

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins...

Malicious code in configure-pages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79cd1afeb9acab2c5d187d719ceadc3a57f71df17a7d824796c4d9fbcb61081b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-M56H-5XX3-2JC2 Prototype pollution in jsii.configureCategories

Summary jsii is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library. When loaded as a library into a larger application...

CVE-2024-54004

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system...

CVE-2024-54004

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system...

CVE-2024-54004

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system...

kernel: iommu: Fix potential use-after-free during probe

A vulnerability was found in the Linux kernel's IOMMU driver, where the deviommufree function can lead to a use-after-free error. This occurs when a device probe fails while simultaneously accessing dev-iommu-fwspec in the ofiommuconfigure path. As a result, this vulnerability can potentially cau...

kernel: iommu: Fix potential use-after-free during probe

A vulnerability was found in the Linux kernel's IOMMU driver, where the deviommufree function can lead to a use-after-free error. This occurs when a device probe fails while simultaneously accessing dev-iommu-fwspec in the ofiommuconfigure path. As a result, this vulnerability can potentially cau...

Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override...

CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2024-52554

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override...

CVE-2024-52554

CVE-2024-52554 affects the Jenkins plugin “Shared Library Version Override” for versions 17.v786074c9fce7 and earlier. The root cause is that folder-scoped library overrides are declared as trusted, so they are not executed inside the Script Security sandbox. This allows a user with Item/Configur...

CVE-2024-52554

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override...

CVE-2024-52552

The CVE-2024-52552 issue affects the Jenkins Authorize Project Plugin (versions ≤ 1.7.2). The root cause is that the plugin evaluates a string containing the job name with JavaScript on the Authorization view, causing a stored XSS vulnerability. Exploitation requires Item/Configure permissions. T...

CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2024-35376 · Jenkins · Jenkins Shared Library Version Override Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Shared Library Version Override Plugin versions 17.v786074c9fce7 and earlier Description: The issue allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox...