CVE-2021-21623: Incorrect Authorization

An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders...

Jenkins Matrix Authorization Strategy 安全漏洞

Jenkins Matrix Authorization Strategy is a Jenkins open source application plugin . The plug-in in Jenkins to achieve fine-grained access control . An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permissions to nested...

Incorrect permission checks in matrix-auth may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. matrix-auth 2.6.5 and earlier does not correctly perform permission checks to determine whether an item...

Incorrect permission checks in role-strategy may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. role-strategy 3.1 and earlier does not correctly perform permission checks to determine whether an item...

OTRS AG OTRSCIsInCustomerFrontend Permission License and Access Control Issues Vulnerability

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A privilege permission and access control issue vulnerability exists in OTRS AG OTRSCIsInCustomerFrontend, which stems from an agent being able to view and...

Talkin’ SMAC: Alert Labeling and Why It Matters

If you’ve ever worked in a Security Operations Center SOC, you know that it’s a special place. Among other things, the SOC is a massive data-labeling machine, and generates some of the most valuable data in the cybersecurity industry. Unfortunately, much of this valuable data is often rendered...

CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

Code injection

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

UBUNTU-CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

CVE-2021-21436

CVE-2021-21436 affects OTRS AG OTRSCIsInCustomerFrontend 7.0.x, specifically version 7.0.14 and earlier. The vulnerability allows agents to see and link Config Items without the required permissions, as defined in General Catalog. The root cause is insufficient access control for configuration it...

PT-2021-14508

Name of the Vulnerable Software and Affected Versions OTRS AG OTRSCIsInCustomerFrontend versions 7.0.14 and prior versions. Description The issue allows agents to see and link Config Items without the necessary permissions, which are defined in the General Catalog. Recommendations For OTRS AG...

OTRS AG OTRSCIsInCustomerFrontend 权限许可和访问控制问题漏洞

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A privilege permission and access control issue vulnerability exists in OTRS AG OTRSCIsInCustomerFrontend, which stems from an agent being able to view and...

CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

Design/Logic Flaw

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...

PT-2021-14369

Name of the Vulnerable Software and Affected Versions: Online Invoicing System OIS version 4.0 Description: The issue is related to a stored XSS in the Online Invoicing System, which can allow an attacker to take over the admin account. This is achieved through a payload that extracts a csrf toke...

OSV-2018-201 Heap-buffer-overflow in r_str_utf16_to_utf8

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10487 Crash type: Heap-buffer-overflow READ 1 Crash state: rstrutf16toutf8 sections rbinobjectsetitems...

PT-2021-27496

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow WRITE 3 crash type. The crash state involves functions such as r bin filter sections, r bin object set...

PT-2021-27539

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves functions such as r str...

PT-2021-27460

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions r read le32, r bin file get strings, and r bin object set items. ...

Cross-site Scripting (XSS)

Overview vis-timeline is a Timeline/Graph2D is an interactive visualization chart to visualize data in time Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker with the ability to control the items of a Timeline element can inject additional script code into...