Information Disclosure

Jenkins Repository Connector is vulnerable information disclosure. Usernames and passwords are stored in plaintext in its global configuration file on the Jenkins master. A local user will be able to retrieve the information and gain access to the application as other users...

CVE-2019-1003038

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...

CVE-2019-1003038

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...

Design/Logic Flaw

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...

CVE-2019-1003038

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java,...

CVE-2019-1003038

CVE-2019-1003038 affects Jenkins Repository Connector Plugin 1.2.4 and earlier, where credentials were stored unencrypted in the plugin’s global configuration file. A local attacker with file-system access or a compromised Jenkins admin browser could retrieve the password from ArtifactDeployer.ja...

PT-2019-11331 · Jenkins · Jenkins Repository Connector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Repository Connector Plugin versions 1.2.4 and earlier Description: The issue allows an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the password stored in the plugin...

The vulnerability of the Apache Tomcat JK (mod_jk) Connector for Apache web servers in relation to the Tomcat Java server, arises from incorrect handling of connection conditions. This allows attackers to bypass established access controls.

The vulnerability of the Apache Tomcat JK modjk Connector for the Apache Tomcat Web Server httpd relates to the improper handling of path normalization and the comparison of the requested path with the URI-worker associative array in modjk. This issue arises due to incorrect processing of path...

OS Command Injection

studio-42/elfinder is vulnerable to OS command injection. Improper processing of the image upload function in the PHP connector allows a remote attacker to inject and execute arbitrary OS commands on the host system...

elFinder 2.1.47 Command Injection

!/usr/bin/python ''' Exploit Title: elFinder SecSignal.php;echo SecSignal.jpg' def usage: if lensys.argv != 2: print "Usage: python exploit.py URL" sys.exit0 def uploadurl, payload: files = 'upload': payload, open'SecSignal.jpg', 'rb' data = "reqid" : "1693222c439f4", "cmd" : "upload", "target" :...

elFinder 2.1.47 - 'PHP connector' Command Injection

!/usr/bin/python ''' Exploit Title: elFinder SecSignal.php;echo SecSignal.jpg' def usage: if lensys.argv != 2: print "Usage: python exploit.py URL" sys.exit0 def uploadurl, payload: files = 'upload': payload, open'SecSignal.jpg', 'rb' data = "reqid" : "1693222c439f4", "cmd" : "upload", "target" :...

Remote code execution via Widget Connector macro - CVE-2019-3396

There was a server-side template injection vulnerability in Confluence Server and Data Center, in the Widget Connector. An attacker is able to exploit this issue to achieve path traversal and remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. ...

elFinder < 2.1.48 Command Injection Vulnerability

elFinder is prone to a command injection vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:std42:elfinder";...

CVE-2019-9194

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector...

Command injection

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector...

CVE-2019-9194

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector...

CVE-2019-9194

The CVE-2019-9194 issue affects elFinder before 2.1.48 (PHP connector). The Nuclei/YAML entry and Exploit-DB records confirm a command injection in the PHP connector triggered during JPEG image operations, where the filename is passed to exiftran without proper sanitization, enabling remote comma...

CVE-2019-9194

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector...

elFinder PHP Connector exiftran Command Injection

This module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is not...

mod_jk: connector path traversal due to mishandled HTTP requests in httpd

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...