Octopus Server information leakage vulnerability

Octopus Server is an automated deployment platform. An information disclosure vulnerability exists in Octopus Server that stems from the fact that when a Windows Tentacle docker image is started, it logs all the commands that it runs as well as the parameters that are written in plaintext to the...

PT-2022-10053

Name of the Vulnerable Software and Affected Versions Windows Tentacle docker image affected versions not specified Description The issue concerns the logging of commands and their arguments when the Windows Tentacle docker image starts up. This results in the Octopus Server API key being written...

CVE-2021-31821: Cleartext Storage of Sensitive Information

When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image...

Exploit for Classic Buffer Overflow in Ipuptime Pinkie

Introduction This repository is setup to quickly test the log...

Improper Input Validation in chatwoot/chatwoot

Description This vulnerability impacts all fields sent to Chatwoot. Any field that has an excessive amount of characters in it will cause the agent's page to take an abnormal amount of time to load, often requiring the content to be removed before the page will load. In my example, I put 20000000...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) +51 more potentially affected by CVE-2022-20617 via org.jenkins-ci.plugins:docker-commons (>=1.0, <=1.15)

org.jenkins-ci.plugins:docker-commons MAVEN version =1.0, =0.1.0, =1.9.2-beta, =1.0-beta-1, =1.2, =1.0-beta-2, =0.1.0-alpha5, =0.17, =1.0.43, =1.0.0-b02, =1.0.0-b15, =1.0.1 and more Source cves: CVE-2022-20617 Source advisory: GHSA-JPXJ-VGQ5-PRJC...

GHSA-JPXJ-VGQ5-PRJC OS command execution vulnerability in Jenkins Docker Commons Plugin

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

OS command execution vulnerability in Jenkins Docker Commons Plugin

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9) +51 more potentially affected by CVE-2022-20617 via org.jenkins-ci.plugins:docker-commons (>=1.0, <=1.15)

org.jenkins-ci.plugins:docker-commons MAVEN version =1.0, =0.1.0, =1.9.2-beta, =1.0-beta-1, =1.2, =1.0-beta-2, =0.1.0-alpha5, =0.17, =1.0.43, =1.0.0-b02, =1.0.0-b15, =1.0.1 and more Source cves: CVE-2022-20617 Source advisory: OSV:GHSA-JPXJ-VGQ5-PRJC...

GHSA-2W8G-M5J8-7M87 Zalgo-like output that crashes the server

Impact What kind of vulnerability is it? Who is impacted? colors package caused zalgo-like output see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289, breaking the servers. Only NPM users that recently upgraded or installed the NPM package are affected...

Zalgo-like output that crashes the server

Impact What kind of vulnerability is it? Who is impacted? colors package caused zalgo-like output see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289, breaking the servers. Only NPM users that recently upgraded or installed the NPM package are affected...

CVE-2022-20617

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

CVE-2021-45449

Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information access token or password on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would...

CVE-2022-20617

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

CVE-2021-45449

Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information access token or password on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would...

CVE-2022-20617

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

CVE-2021-45449

Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information access token or password on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would...

Command injection

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

Information disclosure

Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information access token or password on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would...

CVE-2021-45449

CVE-2021-45449 affects Docker Desktop versions 4.3.0 and 4.3.1. A bug may log sensitive information (access tokens or passwords) on a user’s machine during login. Exploitation requires local access to the user’s files. The description notes that only users who have logged in on 4.3.0/4.3.1 are af...