201 matches found
CVE-2022-43420
CVE-2022-43420 : Jenkins Contrast Continuous Application Security Plugin (versions 3.9 and earlier) contains a stored XSS vulnerability caused by not escaping data returned from the Contrast service when generating a report. Exploitation requires an attacker who can control or modify the Contrast...
Jenkins Contrast Continuous Application Security Plugin 跨站脚本漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site scripting...
CVE-2022-43420: Improper Neutralization of Input During Web Page Generation
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control or modify Contrast service API responses...
Stored XSS vulnerability in contrast-continuous-application-security
contrast-continuous-application-security 3.9 and earlier does not escape data returned from the Contrast service when generating a report. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control or modify Contrast service API responses...
CVE-2022-43420
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control or modify Contrast service API responses...
Malicious code in @contrast-security-inc/design-system-foundations (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48b4683a6b251cef2ea9ceca8762aefd8802af287dc62ddf87ac5c19a1a4b406 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
March 22, 2022—KB5011551 (OS Build 17763.2746) Preview
None None...
Description of the security update for SharePoint Server 2019: May 11, 2021 (KB5001916)
None None...
Description of the security update for SharePoint Server 2019 Language Pack: January 12, 2021
None None...
Contrast Community Edition Empowers Developers to Write Secure Code Faster
As software eats the world, the world faces a software security crisis. The movement to modern software such as cloud technologies and microservice architectures is essential to innovate quickly. Yet, nearly three in four developers say that security slows down Agile and DevOps. Neither developer...
Virtual VCR Max .0a - .vcr Buffer Overflow (PoC)
Virtual VCR Max .0a - .vcr Buffer Overflow PoC !/usr/bin/python Exploit Title: VirtualVCR-Max .0a Overflow PoC Google Dork: N/A Date: 21/02/2019 Exploit Author: Wade Guest Vendor Homepage: http://virtualvcr.sourceforge.net/ Software Link: https://sourceforge.net/projects/virtualvcr/ Version: Max...
unh3x.github.io
Contrast Note Create a master-branch and adjust conf...
Electron WebPreferences - Remote Code Execution Exploit
Exploit for multiple platform in category remote exploits CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested...
Electron WebPreferences - Remote Code Execution
CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windows on Electron versions 3.0.0-beta.6, 2.0.7,...
Microsoft Intelligent Security Association expands with new members and products
Last April, we introduced theMicrosoft Intelligent Security Associationa group of 19 security technology providers who have integrated their solutions with a select set of Microsoft products to provide customers better protection, detection, and response. Today, we are pleased to announce five ne...
A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018
February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...
Struts2 new flaws vulnerability bug（S2-052 presents the use case, and face the vulnerability flaws of the enterprise-the race against time-vulnerability warning-the black bar safety net
Prior to the black bar safety net it S2-052）vulnerabilities done in a special thematic report, I believe we also have understand! Recently from the Cisco Talos experimental study of the analysis chamber and NVISO laboratory for the research staff also found that there was an attacker of real use ...
The [vulnerability analysis] S2-045 principles of the preliminary analysis of CVE-2017-5638-a vulnerability warning-the black bar safety net
Author: angelwhu 0x00 vulnerability announcement See This vulnerability should follow-up will have official detailed analysis. Here to talk about personal understanding, but also to share the following to reproduce the vulnerabilities of ideas. First of all,carefully read the vulnerability...
Windows kernel Vulnerability CVE-2 0 1 6-0 1 4 3 analysis-vulnerability warning-the black bar safety net
4 on 2 0 March, Nils Sommer in the exploitdb on broke a new Windows kernel vulnerability PoC. The vulnerability affects all versions of Windows operating system, the attacker after the success of available privilege escalation, Microsoft in 4, on patch day fixes the vulnerability. 0×0 1...
Jenkins 低权限用户 API 服务调用 可致远程命令执行
漏洞演示 将 Jenkins 跑起来后，在低权限用户下构造 XML 文档： hashCode open /Applications/Calculator.app false 0 0 0 start 1 发送 Payload 至接口 http://...:8080/jenkins/createItem?name=knownsec： 成功后服务端会运行 计算器 程序。 漏洞影响 影响版本： 1.650 （1.650版本已修复该问题） 从zoomeye.org上搜索设备指纹“Jenkins” 从搜索的结果来看，约存在20000个潜在受到影响的目标。 相关链接...