547 matches found
CVE-2021-21631
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...
Code injection
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...
CVE-2021-21631
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...
PT-2021-14674 · Jenkins · Jenkins Cloud Statistics Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Cloud Statistics Plugin versions 0.26 and earlier Description: The issue concerns a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related...
CVE-2021-21631: Missing Authorization
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...
Missing permission check in cloud-stats
cloud-stats 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. cloud-stats 0.27 requires Overall/Administer permission to access...
CSRF vulnerability in libvirt-slave
libvirt-slave 1.9.0 and earlier does not require POST requests for a form submission endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to stop hypervisor domains. libvirt-slave 1.9.1 requires POST requests for the affected HTTP endpoint...
PT-2021-14660 · Jenkins · Jenkins Configuration Slicing Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Configuration Slicing Plugin versions 1.51 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to apply different slice configurations to attacker-specified jobs. This issue arises because the for...
PT-2021-10096 · Apache · Apache Flink
Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.5.1 Description: A REST handler in Apache Flink allows writing an uploaded file to any location on the local file system through a maliciously modified HTTP HEADER. This issue enables files to be written to any locatio...
CVE-2020-25617
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console NAC, leading to execution of OS commands as root...
PT-2020-16134
Name of the Vulnerable Software and Affected Versions SolarWinds N-Central version 12.3.0.670 Description An issue was discovered in the AdvancedScripts HTTP endpoint, which allows Cross-Site Request Forgery CSRF. This means that an attacker can trick a user into performing unintended actions on...
CVE-2020-25622: Cross-Site Request Forgery (CSRF)
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
Design/Logic Flaw
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
CVE-2020-2323
Summary: Jenkins Chaos Monkey Plugin 0.4 and earlier lacks permission checks on an HTTP endpoint. This allows attackers with Overall/Read to access the Chaos Monkey page and view action history. Mitigation: Upgrade to version 0.4.1 or later, which requires Overall/Administer permission to access ...
Missing permission checks in chaos-monkey
chaos-monkey 0.4 and earlier does not perform permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. chaos-monkey 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and ...
Design/Logic Flaw
Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to configure the plugin...