Jenkins RQM Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A code issue vulnerabilit...

Jenkins Compuware Common Configuration Plugin 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2022-25741 · Jenkins · Jenkins Compuware Common Configuration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Common Configuration Plugin versions 1.0.14 and earlier Description: The issue is related to the XML parser not being configured to prevent XML external entity XXE attacks. This allows attackers who can change the contents o...

Vault Entity Alias Metadata May Leak Between Aliases With The Same Name Assigned To The Same Entity

Summary When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability,...

SUSE-SU-2022:3314-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: drools: - CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. bsc1200629 httpcomponents-asyncclient: - Provide maven metadata needed by other packages to build image-sync-formula: - Update to version 0.1.1661440526.b08d95b Add option t...

MAL-2022-7387 Malicious code in zezedb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ad7b177b1f26e0b059bfe28c7c8e04efc356726e476a6fad68e11373750208c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1732 Malicious code in burningred (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46fa626c16108862bd0e44c8161a4b0f9b8fae722e62fb13d45049770eff6cd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a crafted request sent to the /admin/users/userid/memberships/membershipid endpoint containing an additional membershipentityid parameter. This will allow an attacker to update the...

Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...

McAfee DLPe < 11.6.600.212 / 11.9.100 (SB10386)

The version of the McAfee Data Loss Prevention Endpoint DLPe Agent installed on the remote Windows host is prior to 11.6.600.212 or 11.9.100. It is, therefore, affected by a vulnerability caused by improper restriction of XML external entity references which allows a remote attacker to cause the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2021-20353)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Enterprise Service Bus. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a securi...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2021-20454)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Enterprise Service Bus. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a securi...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2021-20492)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Enterprise Service Bus. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a securi...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2020-4949)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Enterprise Service Bus. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a securi...

Security Bulletin: A security vulnerability in FileNet Content Management Interoperability Services (CMIS) might affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) (CVE-2018-1364)

Summary An XML external entity security vulnerability has been reported for FileNet Content Management Interoperability Services CMIS shipped with IBM Business Automation Workflow and IBM BPM. Vulnerability Details CVEID: CVE-2018-1364 DESCRIPTION: IBM Content Navigator 2.0 and 3.0 is vulnerable ...

Malicious code in orangepay-ecommerce-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bea07fa6617b9081136d00c662b7e563d4f1e5c974de09e6f8556fb147a092cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5994 Malicious code in security-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f34f022f6da3bc1dc777a1311e7aaddde9d442e08bc13025aac5639f6695280 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1175 Malicious code in auth-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affca85a0c8e959151ae1b55f6bbc3ac15b328ded165ddd269918b33ab725cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in optimizer-plugin-inc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b2794871339a2d8424d71ca9e8e0514ee68eda9532a9b9877de950becac68a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1692 Malicious code in brogan-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 142de0f01ce74f3ba2a163121986af8504eb87ba0f598ca801d4a5144f4809b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...