GHSA-6MPP-CM3V-23VV Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in...

GHSA-38PM-74XC-PHCW CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

A cross-site request forgery CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins...

@adobe/helix-deploy (>=3.0.0, <=3.16.0), @nordicsemiconductor/asset-tracker-cloud-device-simulator-azure (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2021-28458 via @azure/ms-rest-nodeauth (>=3.0.3, <=3.0.7)

@azure/ms-rest-nodeauth NPM version =3.0.3, =3.0.0, =1.0.0, =1.2.0 - @trulive/sye-tools 3.0.1 Source cves: CVE-2021-28458 Source advisory: GHSA-QPFW-4M9X-RXX8...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +15 more potentially affected by CVE-2020-2229 via org.jenkins-ci.main:jenkins-core (1.651.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aliyun.www:aliyun-container-service-deploy =0.1.0, =y, =1.0.4, =1.004, =1.0, =1.0.6,...

RCE vulnerability in Jenkins AWS SAM Plugin

AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to configure a job or control the contents of a previously configured "AWS SAM deploy...

Jenkins XebiaLabs XL Deploy Plugin vulnerable to Cross-site request forgery (CSRF)

A missing permission check in a form validation method in Jenkins XebiaLabs XL Deploy Plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified credentials. Additionally, the form validation method does not require POST...

GHSA-44W7-GH9C-4QVR Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the CredentialdoValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the CredentialdoValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

GHSA-GRPP-GX5H-PVH8 Jenkins XebiaLabs XL Deploy Plugin vulnerable to Cross-site request forgery (CSRF)

A missing permission check in a form validation method in Jenkins XebiaLabs XL Deploy Plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified credentials. Additionally, the form validation method does not require POST...

Acronis Snap Deploy Elevation of Privilege Vulnerability (CNVD-2022-64257)

Acronis Snap Deploy, an Acronis platform for bulk deployment of system images, is vulnerable to an elevation of privilege vulnerability that stems from assigning too many privileges to child processes, which could be exploited by an attacker to cause a local elevation of privilege...

ceph-deploy uses world-readable permissions on client.admin key

The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

GHSA-79JF-CCM8-43W7 ceph-deploy uses world-readable permissions on client.admin key

The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

GHSA-9W4F-3V37-6F75 ceph-deploy allows local users to obtain sensitive information by reading the file

ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

ceph-deploy allows local users to obtain sensitive information by reading the file

ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

CVE-2022-30695

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30696

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30695

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30696

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3640...