CVE-2025-66249

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...

CVE-2025-66249

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before 0.9.0. The vulnerability can only be exploited with non-default Apache Livy Server settings. If the configuration value...

EUVD-2022-4503

Malicious code in bioql PyPI...

PT-2021-22405 · Xstream +5 · Xstream +5

Name of the Vulnerable Software and Affected Versions: XStream versions prior to 1.4.18 Description: The issue allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This can be done when using affected versions of XStream, a...

CloudBees Jenkins Script Security plugin security bypass vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Script Security is one of the plug-ins used to detect the script security . A...

CVE-2017-1000095

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...

CVE-2017-1000095

CVE-2017-1000095 concerns the Jenkins Script Security plugin where the default whitelist contains unsafe entries (DefaultGroovyMethods.putAt and DefaultGroovyMethods.getAt) that bypass sandbox restrictions (e.g., via currentBuild['rawBuild'] vs currentBuild.rawBuild) and allow accessing private d...

jenkins-plugin-script-security: Unsafe methods in the default whitelist (SECURITY-538)

The jenkins-plugin-script-security improperly whitelisted "DefaultGroovyMethods.putAtObject, String, Object" and "DefaultGroovyMethods.getAtObject, String" which allows attackers to bypass many restrictions and potentially trigger builds or access data they should not have access to. Exploitation...