Jenkins Plugin Semantic Versioning 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

MAL-2023-110 Malicious code in attacker_present_helloworld (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9129d8a2299c74952dd32fde1d04f17434b86d0ac21e4ec06d5bedd681db53b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploiting a Critical Spoofing Vulnerability in Windows CryptoAPI

Akamai researchers have analyzed a critical vulnerability in Microsoft's CryptoAPI that would allow an attacker to masquerade as a legitimate entity...

Improper restriction of XML external entity reference (XXE) vulnerability in OMRON CX-Motion Pro

Overview CX-Motion Pro provided by OMRON Corporation contains an improper restriction of XML external entity reference XXE vulnerability CWE-611. Michael Heinzl reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact If a user opens a specially crafted project...

AlmaLinux 9 : libxml2 (ALSA-2023:0338)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0338 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several intege...

PT-2023-19590 · Jenkins · Jenkins Semantic Versioning Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Semantic Versioning Plugin versions 1.14 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. This allows for potential exploitation...

CVE-2023-24430

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2023-19603 · Jenkins · Jenkins Testcomplete Support Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TestComplete support Plugin versions 2.8.1 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. This allows for potential exploitation...

Oracle Linux 9 : libxml2 (ELSA-2023-0338)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0338 advisory. - Fix CVE-2022-40303 2136564 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

CVE-2023-24441

Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2023-19601 · Jenkins · Jenkins Mstest Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MSTest Plugin version 1.0.0 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. Recommendations: For Jenkins MSTest Plugin version 1.0.0 and...

MAL-2023-132 Malicious code in bi0s-css-3bd27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d336d45273f8a33390c42868241722a95b100229eca3109cdc11b15765a263a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

New BOLDMOVE Backdoor uses FortiOS vulnerability for initial access

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A suspected China-nexus campaign has exploited a vulnerability in Fortinets FortiOS SSL-VPN, known as CVE-2022-42475. The exploitation was believed to have occurred as early as October 2022 and the targe...

MAL-2023-128 Malicious code in best-man-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15fa50f52202384b37b1b714460696e713ae0766713264f909b1a18d42847bea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-131 Malicious code in best-man-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 857e7086f034250f74e644b60c344c9f9c781fc81531cebb43f949d09195c6c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Debian: Security Advisory (DLA-3276-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3276-1] lava security update

Debian LTS Advisory DLA-3276-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 19, 2023 https://wiki.debian.org/LTS Package : lava Version : 2019.01-5+deb10u2 CVE ID : CVE-2022-44641 Debian Bug : 1024429 Igor Ponomarev discovered that LAVA, a continuous...