org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0, <=2.0.2-beta-1), org.jenkins-ci.plugins:github-branch-source (>=2.0.0, <=2.0.1-beta-6) +1 more potentially affected by CVE-2018-1000182 via org.jenkins-ci.plugins:git (2.6.2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0, =2.0.0, =2.0.1-beta-6 -...

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Cross-site scripting XSS vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site reque...

GHSA-4VWQ-X64Q-J4CJ Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Cross-site scripting XSS vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site reque...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (2.0.0-beta-1), org.jenkins-ci.plugins:github-branch-source (2.0.0-beta-2) +1 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.2-beta-2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source 2.0.0-beta-1 -...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.0.0, <=2.0.2-beta-1), org.jenkins-ci.plugins:github-branch-source (>=2.0.0, <=2.0.1-beta-6) +1 more potentially affected by CVE-2019-1003010 via org.jenkins-ci.plugins:git (2.6.2)

org.jenkins-ci.plugins:git MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.0.0, =2.0.0, =2.0.1-beta-6 -...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2017-1000395 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

GHSA-QGJQ-M78X-4GM8 Improper Authentication in Jenkins Blue Ocean Plugin

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...

Improper Authentication in Jenkins Blue Ocean Plugin

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0, <=1.0.1), org.jenkins-ci.main:jenkins-test-harness (1.548) +7 more potentially affected by CVE-2017-1000400 via org.jenkins-ci.main:jenkins-core (1.548)

org.jenkins-ci.main:jenkins-core MAVEN version 1.548 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =4.3, =4.6.1 -...

GHSA-87VG-5PGX-PGGH spring-integration-zip Arbitrary File Write

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the admin/install.php script. An attacker can inject arbitrary JavaScript code by manipulating input fields such as $fdatabase, $fdbusername, and $fadminusername...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

Local privilege escalation due to insecure folder permissions

...

CVE-2022-23139

ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could...

CVE-2022-23139

ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could...

ZTE ZXMP M721 权限许可和访问控制问题漏洞

The ZTE ZXMP M721 is a metro edge OTN Optical Transport Network device from ZTE Corporation ZTE in China.The ZTE ZXMP M721 has a privilege and access control vulnerability, which stems from the fact that the folder privilege viewed by sftp is 666, which is inconsistent with the actual privilege,...

CVE-2022-23743

Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading t...

PT-2022-20157

Name of the Vulnerable Software and Affected Versions Trend Micro Password Manager Consumer version 5.0.0.1266 and below Description The issue allows a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM, which can then be used for privilege escalation on the...

Git Access Control Privilege Escalation

The vulnerability of the distributed Git version control system relates to the possibility of creating a folder named “C:.git”. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...