Missing permission check in Jenkins Gerrit Trigger Plugin

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...

GHSA-XM94-9JW8-P6HW Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

GHSA-4HX9-P925-QCV7 phpBB Server side request forgery (SSRF)

Server side request forgery SSRF in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function...

GHSA-W393-H95M-F879 CoreFTP Directory Traversal

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a ....\ substring, allowing an attacker to enumerate file existence based on the returned information...

GHSA-X446-3XHQ-5XFP Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

Design/Logic Flaw

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

CVE-2022-27814 relates to SWHKD 1.1.5, where the -c option allows arbitrary file-existence tests. The connected sources confirm the vulnerable component is the SWHKD daemon and the condition is a flaw in the -c flag that enables probing for file presence, implying local, low-complexity exploitati...

CVE-2022-27814

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

PT-2022-3802 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD version 1.1.5 Description: The issue is related to a lack of proper access control in the SWHKD implementation of the Wayland display server protocol, specifically when handling files with the -c option. This can allow an attacker to...

ALPINE-CVE-2021-44141

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...

AZL-8610 CVE-2021-44141 affecting package samba 4.12.5-7

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...

CVE-2022-25204

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists...

CVE-2022-25204

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists...

CVE-2022-25204

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists...

PT-2022-17143 · Jenkins · Jenkins Doktor Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Doktor Plugin version 0.4.1 and earlier Description: The issue allows attackers who can control agent processes to determine whether a file with a given name exists on the controller, by exploiting the functionality that renders files...