org.jvnet.hudson.plugins:instant-messaging (>=1.38, <=1.39), org.jvnet.hudson.plugins:ircbot (>=2.31, <=2.33) potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.26)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jvnet.hudson.plugins:instant-messaging =1.38, =2.31, =2.33 Source...

org.jenkins-ci.plugins:test-results-aggregator (>=1.0.0, <=1.1.7), org.jvnet.hudson.plugins:instant-messaging (>=1.37, <=1.39) +1 more potentially affected by CVE-2022-45380 via org.jenkins-ci.plugins:junit (1.7)

org.jenkins-ci.plugins:junit MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:test-results-aggregator =1.0.0, =1.37, =2.31, =2.33 Source cves: CVE-2022-45380...

org.jvnet.hudson.plugins:instant-messaging (>=1.38, <=1.39), org.jvnet.hudson.plugins:ircbot (>=2.31, <=2.33) potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.21)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jvnet.hudson.plugins:instant-messaging =1.38, =2.31, =2.33...

org.jvnet.hudson.main:hudson-war (1.132), org.jvnet.hudson.plugins:ircbot (1.7) +2 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (1.132)

org.jvnet.hudson.main:hudson-core MAVEN version 1.132 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.jvnet.hudson.main:hudson-war 1.132 - org.jvnet.hudson.plugins:ircbot 1.7 -...

org.jenkins-ci.plugins:test-results-aggregator (>=1.0.0, <=1.1.7), org.jvnet.hudson.plugins:instant-messaging (>=1.37, <=1.39) +1 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.7)

org.jenkins-ci.plugins:junit MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:test-results-aggregator =1.0.0, =1.37, =2.31, =2.33 Source cves: CVE-2022-34176...

org.jenkins-ci.plugins:mypeople (>=0.3, <=0.3.0.3), org.jenkins-ci.plugins:skype-notifier (>=1.0, <=1.1.0) +2 more potentially affected by CVE-2022-28135 via org.jvnet.hudson.plugins:instant-messaging (>=1.0, <=1.38)

org.jvnet.hudson.plugins:instant-messaging MAVEN version =1.0, =0.3, =1.0, =2.0, =unspecified, =1.41 Source cves: CVE-2022-28135 Source advisory: GHSA-HPM9-FX8V-W45V...

org.jenkins-ci.plugins:mypeople (>=0.3, <=0.3.0.3), org.jenkins-ci.plugins:skype-notifier (>=1.0, <=1.1.0) +2 more potentially affected by CVE-2022-28135 via org.jvnet.hudson.plugins:instant-messaging (>=1.0, <=1.38)

org.jvnet.hudson.plugins:instant-messaging MAVEN version =1.0, =0.3, =1.0, =2.0, =unspecified, =1.41 Source cves: CVE-2022-28135 Source advisory: OSV:GHSA-HPM9-FX8V-W45V...

org.jenkins-ci.plugins:mypeople (>=0.3, <=0.3.0.3), org.jenkins-ci.plugins:skype-notifier (>=1.0, <=1.1.0) +2 more potentially affected by CVE-2022-28135 via org.jvnet.hudson.plugins:instant-messaging (>=1.0, <=1.38)

org.jvnet.hudson.plugins:instant-messaging MAVEN version =1.0, =0.3, =1.0, =2.0, =unspecified, =1.41 Source cves: CVE-2022-28135 Source advisory: MEND:CVE-2022-28135...

ircbot stores credentials in plain text

ircbot stores credentials unencrypted in its global configuration file hudson.plugins.ircbot.IrcPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Threat Roundup for March 8 to March 15

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 08 and March 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Threat Roundup for Jan. 25 to Feb. 1

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 25 and Feb. 01. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

MongoDB management tool exposure remote code execution vulnerability-vulnerability warning-the black bar safety net

MongoDB, the IT sector mainstream non-relational database NoSQL platform is one that is based on a table of a relational database of the popular alternatives. Recently, the management for MongoDB is a GUI tool phpMoAdmin is the storm has a very serious security vulnerability, once exploited, this...

Eggdrop arbitrary connection vulnerability

Hi, there is a serious security problem in the popular eggdrop IRCbot. The hole allows a regular user with enough 'power' at least power to add new bot records to use any linked instance of the bot on the botnet as an instant 'proxy'. The following session demonstrates the problem with an...