PT-2024-19247

Name of the Vulnerable Software and Affected Versions Jenkins docker-build-step Plugin versions 2.11 and earlier Description A missing permission check in an HTTP endpoint allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure...

PT-2024-19236

Name of the Vulnerable Software and Affected Versions Jenkins docker-build-step Plugin versions 2.11 and earlier Description A cross-site request forgery issue allows attackers to connect to a specified TCP or Unix socket URL and reconfigure the plugin, affecting future build step executions...

CVE-2024-2215: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...

Amazon Linux 2023 : docker (ALAS2023-2024-542)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-542 advisory. 2024-08-28: CVE-2023-45289 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from...

Jenkins docker-build-step Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

AZL-35641 CVE-2024-24786 affecting package docker-buildx for versions less than 0.14.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35642 CVE-2024-24786 affecting package docker-cli for versions less than 25.0.3-2

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35643 CVE-2024-24786 affecting package docker-compose for versions less than 2.27.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: cass-operator-fips, kargo, kyverno-policy-reporter-ui, kube-state-metrics, zot, gh, chartmuseum, tflint, volume-modifier-for-k8s-fips, spire-server, temporal-ui-server-fips, kubernetes-dns-node-cache, secrets-store-csi-driver-provider-aws, helm-push, runc,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, hey, ferretdb, tflint, kubernetes-csi-external-provisioner, http-echo, nats, nri-nginx, kpt, goreleaser, temporal, cni-plugins, kube-bench, helm-push, lazygit, buildkitd, nri-mssql, nri-mongodb, sonobuoy, kubernetes-csi-external-resizer,...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

CVE-2024-27198 CVE-2024-27198 - Authentication Bypass Usi...

Mozilla: two aws access key and secret key and database username and password exposed

A security vulnerability was identified in a Docker image hosted on Docker Hub. The image, associated with Mozilla's Common Voice project, was found to contain exposed AWS access keys, AWS secret keys, and database credentials. These sensitive credentials were discovered within the file...

Exploit for Injection in Atlassian Confluence_Data_Center

Executing Arbitrary Code In Confluence Memory CVE-2023-22527...

openSUSE: Security Advisory for docker (SUSE-SU-2023:3536-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2024-26280 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2024-26280 Source advisory: OSV:GHSA-6XWF-XVF3-V459...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2024-26280 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2024-26280 Source advisory: OSV:PYSEC-2024-42...

GHSA-PCFX-G2J2-F6F6 Docassemble HTML and javascript injection

Impact A user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags allowing JavaScript to execute on the page. Patches The vulnerability has been patched in version 1.4.97 of the master...

Docassemble HTML and javascript injection

Impact A user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags allowing JavaScript to execute on the page. Patches The vulnerability has been patched in version 1.4.97 of the master...

GHSA-7WXF-R2QV-9XWR Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...

Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...