45 matches found
CVE-2023-32986
Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...
GHSA-584M-7R4M-8J6V Incorrect Authorization in Jenkins Core
When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and , and LTS prior to 2.387.1 creates this temporary file in the default temporar...
HTMLy 路径遍历漏洞
HTMLy is a PHP-based open source blogging platform. A path traversal vulnerability exists in HTMLy versions prior to 2.8.1. A remote attacker can exploit this vulnerability to delete arbitrary files with the help of modified file parameters...
Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin
Pipeline: Input Step Plugin 448.v37cea9a10a70 and earlier allows Pipeline authors to specify file parameters for Pipeline input steps even though they are unsupported. Although the uploaded file is not copied to the workspace, Jenkins archives the file on the controller as part of build metadata...
CVE-2022-34177
Jenkins Pipeline: Input Step Plugin 448.v37cea9a10a70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers...
PT-2022-22044 · Jenkins · Jenkins Pipeline: Input Step Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Input Step Plugin versions 448.v37cea 9a 10a 70 and earlier Description: The issue allows attackers who can configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specifi...
PublicCMS has an unspecified vulnerability
PublicCMS is an open source content management system CMS written in Java from PublicCMS, China. publicCMS v4.0 contains a security vulnerability that stems from a problem in the BAT file parameters. An attacker can exploit this vulnerability to execute arbitrary code...
CVE-2021-40881
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code...
CVE-2021-40881
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code...
PublicCMS 安全漏洞
PublicCMS is an open source content management system CMS written in Java from PublicCMS, China. publicCMS v4.0 contains a security vulnerability that stems from a problem in the BAT file parameters. An attacker can exploit this vulnerability to execute arbitrary code...
CVE-2020-2162
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
CVE-2021-22397
There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service...
CVE-2021-22397
There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service...
Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by a security vulnerability (CVE-2016-0392)
Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale and IBM GPFS that could allow a local attacker to inject commands into setuid file parameters and execute commands as root. Vulnerability Details CVEID: CVE-2016-0392 DESCRIPTION: IBM General Parallel File...
Sourcecodester Seat-Reservation-System SQL注入漏洞
Seat-Reservation-System is a seat reservation system. A sql injection vulnerability exists in Seat-Reservation-System 1.0. The vulnerability is caused due to the id and file parameters in the index.php file not being input/output filtered for special characters. An attacker can exploit this...
jenkins: Content-Security-Policy headers for files uploaded leads to XSS
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
CVE-2020-2162
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
Arbitrary File Read
dompdf is vulnerable to arbitrary file read. A malicious user can bypass chroot protections with the PHP protocols and wrappers through the inputfile parameters...
ZZCMS V8.0 SQL Injection Vulnerability in Multiple Parameters
ZZCMS is an enterprise website builder. ZZCMS V8.0 suffers from a SQL injection vulnerability, which allows attackers to exploit the vulnerability to obtain sensitive information from the database. The injection parameters include the following: zs/zs.php file 'pxzs' function;...
