com.fnproject.fn:fn-spring-cloud-function (>=1.0.110, <=1.0.146), com.github.roneetshaw:fn-spring-cloud-function (>=0.0.22, <=2.0.21) +26 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

django-fab-deployer (>=0.0.4, <=0.0.11) potentially affected by CVE-2022-24302 via paramiko (1.15.1)

paramiko PYPI version 1.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - django-fab-deployer =0.0.4, =0.0.11 Source cves: CVE-2022-24302 Source advisory: OSV:PYSEC-2022-166...

Non-transferable critical privileged role

Handle gzeon Vulnerability details Impact DEPLOYER is a constant in Manager and it is the only role that can call setSherlockCoreAddress to change sherlockCore address. Consider this is a critical function and there might be a need to change the deplorer address in the future e.g. governance...

DEPLOYER can drain underlying asset deposited by AaveV2Strategy and drain SHER token in SherDistributionManager

Handle wuwe1 Vulnerability details Proof of Concept For sdm. DEPOLYER can call pullReward and send arbitrary amount of sher in sdm to the DEPOLYER. For AaveV2Strategy.sol , attacker can call withdrawAll and drain the underlying asset if there is any. Recommended Mitigation Steps Add Timelock on...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.1), org.eclipse.jetty.aggregate:jetty-all (7.6.2.v20120308) +53 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.2.v20120308)

org.eclipse.jetty:jetty-server MAVEN version 7.6.2.v20120308 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.1 -...

org.jenkins-ci.plugins:crx-content-package-deployer (>=1.5, <=1.9) potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.17)

org.jenkins-ci.plugins:credentials MAVEN version 1.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:crx-content-package-deployer =1.5, =1.9 Source cves: CVE-2021-21648...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: OSV:GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

cn.xphsc.boot:kubernetes-spring-boot-starer (1.0.0-rc), com.bybutter.sisyphus.middleware:sisyphus-grpc-client-kubernetes (>=0.0.6-m0, <=0.0.6-m3) +11 more potentially affected by CVE-2020-8570 via io.kubernetes:client-java (>=9.0.0, <=9.0.1)

io.kubernetes:client-java MAVEN version =9.0.0, =0.0.6-m0, =0.9.8.3, =0.9.8.3, =0.9.8.3, =9.0.0, =9.0.0, =9.0.0, =3.6.17, =5.0.0 Source cves: CVE-2020-8570 Source advisory: GHSA-CGHX-9GCR-R42X...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15680 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15682 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15683 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.2), org.eclipse.jetty.aggregate:jetty-all (7.6.3.v20120416) +27 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.6.3.v20120416)

org.eclipse.jetty:jetty-webapp MAVEN version 7.6.3.v20120416 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.2 -...

com.hazelcast:hazelcast-jetty7-sessionmanager (>=1.0, <=1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (>=1.1.9, <=2.0.0) +29 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.6.16.v20140903)

org.eclipse.jetty:jetty-webapp MAVEN version 7.6.16.v20140903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - com.hazelcast:hazelcast-jetty7-sessionmanager =1.0, =1.1.9, =1.4.10, =1.4.14 -...

com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x (>=1.0.1, <=1.0.2), org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (>=1.4.15, <=1.6.7) +22 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (7.6.17.v20150415)

org.eclipse.jetty:jetty-webapp MAVEN version 7.6.17.v20150415 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-webapp and may be impacted: - com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x =1.0.1, =1.4.15, =1.6.7 -...

CloudBees Jenkins OpenShift Deployer Plugin Has Unspecified Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.OpenShift Deployer Plugin is used in one of the...

CloudBees Jenkins Deployer Framework Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

Vulnerabilities fixed in Jenkins

Several vulnerabilities have been fixed in Jenkins. A malicious user could potentially exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. A such an attack can lead to the execution of arbitrary script code in the browser used to visit the application. Jenkins developers hav...