org.jenkins-ci.main:jenkins-test-harness (1.424.3), org.jenkins-ci.main:jenkins-war (1.424.3) +4 more potentially affected by CVE-2018-1000408 via org.jenkins-ci.main:jenkins-core (1.424.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.424.3 - org.jenkins-ci.main:jenkins-war 1.424.3 -...

GHSA-QG25-HGJV-CG9Q Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object...

GHSA-P8X8-P473-MMMV Missing Authorization in Jenkins

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/job-name/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and...

org.jenkins-ci.main:jenkins-test-harness (1.424.3), org.jenkins-ci.main:jenkins-war (1.424.3) +4 more potentially affected by CVE-2017-1000400 via org.jenkins-ci.main:jenkins-core (1.424.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.424.3 - org.jenkins-ci.main:jenkins-war 1.424.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.424.3), org.jenkins-ci.main:jenkins-war (1.424.3) +4 more potentially affected by CVE-2017-2611 via org.jenkins-ci.main:jenkins-core (1.424.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.424.3 - org.jenkins-ci.main:jenkins-war 1.424.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.424.3), org.jenkins-ci.main:jenkins-war (1.424.3) +4 more potentially affected by CVE-2019-1003004 via org.jenkins-ci.main:jenkins-core (1.424.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.424.3 - org.jenkins-ci.main:jenkins-war 1.424.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.438), org.jenkins-ci.main:jenkins-war (1.438) +6 more potentially affected by CVE-2017-2601 via org.jenkins-ci.main:jenkins-core (1.438)

org.jenkins-ci.main:jenkins-core MAVEN version 1.438 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.438 - org.jenkins-ci.main:jenkins-war 1.438 -...

org.jenkins-ci.main:jenkins-test-harness (1.424.3), org.jenkins-ci.main:jenkins-war (1.424.3) +4 more potentially affected by CVE-2018-1999005 via org.jenkins-ci.main:jenkins-core (1.424.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.424.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.424.3 - org.jenkins-ci.main:jenkins-war 1.424.3 -...

A little actually doesn’t go a long way: Fight the urge to shortcut your TPRM program

Third Party Risk Management TPRM is hard to get right. Ineffective TPRM is when 83% of legal and compliance leaders identify third party risks after due diligence, despite spending 73% of effort on due diligence. This is supported by 49% of business leaders saying they lack a centralized strategy...

Deserialization of untrusted data

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case,...

CVE-2022-24818 Unchecked JNDI lookups in GeoTools

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case,...

envoy: Use-after-free when tunneling TCP over HTTP

A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service...

envoy: Use-after-free when tunneling TCP over HTTP

A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service...

CVE-2021-27493

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component...

CVE-2021-27493 Philips Vue PACS

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component...

Envoy Resource Management Error Vulnerability (CNVD-2022-15542)

Envoy is an open source distributed proxy server. Envoy is vulnerable to a resource management error that occurs when configuring "envoyv3apifieldextensions.filters.network.tcpproxy.v3. tunnelingconfig" crashes and the downstream connection is disconnected while the upstream connection or http/2...

CVE-2021-43826: Use After Free

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:upstream tunneling and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established...

PT-2022-11915 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: A crash occurs in Envoy when it is configured for upstream tunneling and the downstream connection disconnects while the upstream connection or HTTP/2 stream is still being established...

Envoy resource management error vulnerability

Envoy is an open source distributed proxy server. Envoy is vulnerable to a resource management error that occurs when configuring "envoyv3apifieldextensions.filters.network.tcpproxy.v3. tunnelingconfig" crashes and the downstream connection is disconnected while the upstream connection or http/2...

Design/Logic Flaw

A segmentation fault during PCF file parsing in pcf2bdf versions =1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. This crash affects the availability of the software and dependent downstream components...