EUVD-2022-4648

Malicious code in bioql PyPI...

com.apica:apicaloadtest (>=1.1, <=1.10), com.infullmobile.jenkins.plugin:restricted-register (0.1.7) +4 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.610)

org.jenkins-ci.main:jenkins-core MAVEN version 1.610 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.apica:apicaloadtest =1.1, =1.4, =1.7.2 - org.jenkins-ci.plugins:plugin 1.610 Source cves:...

MAL-2025-24149 Malicious code in k8s-ssdeployer (npm)

The package k8s-ssdeployer was found to contain malicious code...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2022-41235

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system...

CVE-2022-36909

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system ...

CVE-2022-36906

A cross-site request forgery CSRF vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password...

CVE-2022-36890

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2022-36907

A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password...

CVE-2022-36891

A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs...

CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

CVE-2020-2227

Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability...

CVE-2019-1003081

A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptordoCheckLogin form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003072

Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-1003080

A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptordoCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003056

Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

com.apica:apicaloadtest (>=1.1, <=1.10), com.infullmobile.jenkins.plugin:restricted-register (0.1.7) +4 more potentially affected by CVE-2025-27624 via org.jenkins-ci.main:jenkins-core (1.610)

org.jenkins-ci.main:jenkins-core MAVEN version 1.610 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.apica:apicaloadtest =1.1, =1.4, =1.7.2 - org.jenkins-ci.plugins:plugin 1.610 Source cves:...

com.github.dblock.waffle:waffle-tomcat8 (1.8.0), net.stickycode.deploy:sticky-deployer-tomcat8 (2.1) +4 more potentially affected by CVE-2024-52316 via org.apache.tomcat:tomcat-catalina (8.0.26)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.github.dblock.waffle:waffle-tomcat8 1.8.0 - net.stickycode.deploy:sticky-deployer-tomcat...

From Spring Cloud Data Flow 2.11.x to 3.0

Dear Spring Community, With the recent announcement of Spring Framework 7.0 and Spring Boot 4.0, the Spring Cloud Data Flow team is pleased to announce the next major release, SCDF 3.0, to align with both Spring Framework 7.0 and Spring Boot 4.0. This will bring the following SCDF ecosystem of...

org.jenkins-ci.plugins:crx-content-package-deployer (>=1.5, <=1.9) potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.17)

org.jenkins-ci.plugins:credentials MAVEN version 1.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:crx-content-package-deployer =1.5, =1.9 Source cves: CVE-2024-47805...