PT-2023-9228 · Trend Micro · Trend Micro Apex One

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Description: An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. The vulnerability is related to...

Inosoft VisiWin 安全漏洞

Inosoft VisiWin is a software platform for human machine interface HMI and process data visualization from Inosoft Corporation. A security vulnerability exists in Inosoft VisiWin version 7 2022-2.1 that originates from the creation of an insecure folder during installation, which could allow a...

Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Vulnerability

Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Privilege Escalation Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://www.inosoft.com/ Version: Up to 2022-2.1 Runtime RT7.3 RC3 20221209.5 Tested on: Windows CVE: CVE-2023-31468 Inoso...

TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions

Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.2.14 Tested on: Windows CVE : CVE-2023-31067 TSplus Remote Access v...

Information Disclosure

org.jenkins-ci.plugins, cloudbees-folder is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly restrict the organization folder log file location, which allows an attacker to gain access to sensitive information in the system...

Cross-Site Request Forgery (CSRF)

gin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability occurs because the plugin does not require POST requests for an HTTP endpoint, which allows allows an attacker to copy a malicious folder, which could then be used to steal data or execute arbitrary code...

CVE-2023-40338

A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin display an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available. This flaw exposes information about the Jenkins controller fi...

CVE-2023-40336

A flaw was found in the Jenkins Folders Plugin. Affected versions of this plugin allow attackers to copy folders...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.11-beta-2, <=1.11-beta-3), org.jenkins-ci.plugins:branch-api (>=0.2-beta-6, <=0.2-beta-7) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.1-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.1-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =1.11-beta-2,...

org.jenkins-ci.plugins.workflow:workflow-multibranch (2.10-beta-1), org.jenkins-ci.plugins:branch-api (2.0.0-beta-1) +2 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.15)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch 2.10-beta-1 -...

io.jenkins.blueocean:blueocean-github-pipeline (1.0.0-b19-beta-1), org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.10, <=2.11-beta-1) +2 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.16)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.jenkins.blueocean:blueocean-github-pipeline 1.0.0-b19-beta-1 -...

org.jenkins-ci.plugins.workflow:workflow-multibranch (1.11-beta-1), org.jenkins-ci.plugins:branch-api (0.2-beta-5) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (4.11-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.11-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch 1.11-beta-1 -...

org.jenkins-ci.plugins:seed (>=0.8.0, <=0.20.0) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (4.7)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:seed =0.8.0, =0.20.0 Source cves: CVE-2023-40336 Source...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.4, <=0.4.1), org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.11, <=1.14-beta-1) +3 more potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.4, =1.11, =1.0...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.1, <=2.4), org.jenkins-ci.plugins:github-organization-folder (>=1.3, <=1.4) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (5.8)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.1, =1.3, =1.4 Source cves:...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0, <=2.54.0), com.datapipe.jenkins.plugins:hashicorp-vault-plugin (>=2.0.0, <=2.2.0) +46 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (>=6.0.1, <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =6.0.1, =2.33.0, =2.0.0, =7.5.7, =1.0.31, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.2.0, =1.1.0-beta-4, =1.27.11 and more Source cves: CVE-2023-40337 Source advisory:...

org.jenkins-ci.plugins:job-dsl (>=1.20, <=1.28) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.2)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.20, =1.28 Source cves: CVE-2023-40337 Source...

io.jenkins.blueocean:blueocean (>=1.0.0-b19-beta-1, <=1.0.0-b21-beta-1), io.jenkins.blueocean:blueocean-config (>=1.0.0-b19-beta-1, <=1.0.0-b21-beta-1) +8 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.17-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b19-beta-1, =1.0.0-b19-beta-1,...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.4, <=0.4.1), org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.11, <=1.14-beta-1) +3 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.4, =1.11, =1.0...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.11-beta-2, <=1.11-beta-3), org.jenkins-ci.plugins:branch-api (>=0.2-beta-6, <=0.2-beta-7) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.1-beta-1)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.1-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =1.11-beta-2,...