Dependency-Track 安全漏洞

Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.6.0, which stems from the fact that executing an API request with a valid API key with insufficient...

MAL-2022-1362 Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-XFRW-PCMC-R2P3 Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

GHSA-V7XH-H48C-XW5F CSRF vulnerability and in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

Jenkins Plugins Multiple Vulnerabilities (Jenkins Security Advisory 2021-03-30)

According to their self-reported version numbers, the versions of Jenkins plugins running on the remote web server are Jenkins Build With Parameters Plugin prior to 1.5.1, Cloud Statistics Plugin prior to 0.27, Extra Columns Plugin prior to 1.23, Jabber XMPP notifier and control Plugin prior to...

CloudBees Jenkins OWASP Dependency-Track Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

CloudBees Jenkins OWASP Dependency-Track Plugin Improper Authorization Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An improper authorization...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21632

A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21632

A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

Information disclosure

A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

A cross-site request forgery CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins...

CVE-2021-21633

Summary (CVE-2021-21633) : A CSRF vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows an attacker to connect to an attacker-specified URL and capture credentials stored in Jenkins. The issue can be exploited by users with Overall/Read permission and does not require PO...

CVE-2021-21632

The CVE-2021-21632 issue affects Jenkins OWASP Dependency-Track Plugin (3.1.0 and earlier). The root cause is missing permission checks in several HTTP endpoints, allowing attackers with Overall/Read to connect to an attacker-specified URL and capture credentials stored in Jenkins (including Secr...