CVE-2019-10382

Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM...

CVE-2019-10381

Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM...

CVE-2019-10382

CVE-2019-10382 affects Jenkins VMware Lab Manager Slaves Plugin versions 0.2.8 and earlier. The vulnerability stems from the plugin disabling SSL/TLS and hostname verification globally for the Jenkins master JVM, creating a trust and MITM risk for TLS connections. Documented impacts indicate pote...

PT-2019-6387 · Jenkins · Jenkins Vmware Lab Manager Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VMware Lab Manager Slaves Plugin versions 0.2.8 and earlier Description: The issue is related to the disabling of global SSL/TLS and hostname verification for the Jenkins master JVM, which could allow a remote attacker to perform a...

ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under...

CVE-2017-18407

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

Design/Logic Flaw

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

Code injection

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18407

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download SEC-279...

CVE-2017-18407

CVE-2017-18407 affects cPanel before 67.9999.103, where SSL hostname verification is not enforced for the support‑agreement download (SEC-279). This is the concrete vulnerability described across multiple connected records. The available documents do not provide exploit details, impact specifics ...

CVE-2017-18398

The CVE-2017-18398 entry refers to cPanel's DnsUtils prior to version 68.0.15, where zone creation is possible for hostname and account subdomains (SEC-331). This is documented across multiple connected sources (RH/CVE, NVD, CNVD/CNVD-2019-36129) indicating a vulnerability in the DNS management u...

Malicious Package

serilize is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

mogodb-core is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

body-parse-xml is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

js-regular is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

Malicious Package

import-mysql is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...

python27:2.7 bug fix update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Bug Fixes:...

python3 bug fix update

An update is available for python3. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Bug Fixes: urlsplit doesn't accept a NFKD hostname with a port number BZ17147...

nodejs: Hostname spoofing in URL parser for javascript protocol

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" e.g. "javAscript:" protoc...