CVE-2021-21437

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions...

Code injection

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions...

OTRS AG OTRSCIsInCustomerFrontend 权限许可和访问控制问题漏洞

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A security vulnerability exists in OTRSCIsInCustomerFrontend that originates from viewing linked configuration items, which are defined in a common director...

PT-2021-14509 · Unknown · Otrs Ag Otrscisincustomerfrontend +1

Name of the Vulnerable Software and Affected Versions: OTRSCIsInCustomerFrontend versions 7.0.15 and prior ITSMConfigurationManagement versions 7.0.24 and prior Description: The issue allows agents to see linked Config Items without the necessary permissions, which are defined in the General...

CVE-2021-21624

An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders...

CVE-2021-21624

An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders...

Authorization

An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders...

CVE-2021-21623

An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders...

Jenkins Matrix Authorization Strategy 安全漏洞

Jenkins Matrix Authorization Strategy is a Jenkins open source application plugin . The plug-in in Jenkins to achieve fine-grained access control . An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permissions to nested...

Incorrect permission checks in matrix-auth may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. matrix-auth 2.6.5 and earlier does not correctly perform permission checks to determine whether an item...

Incorrect permission checks in role-strategy may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. role-strategy 3.1 and earlier does not correctly perform permission checks to determine whether an item...

PT-2021-14666 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: Jenkins Matrix Authorization Strategy Plugin versions 2.6.5 and earlier Description: The issue arises from an incorrect permission check, allowing attackers with Item/Read permission on nested items to access them even if they lack Item/Read...

OTRS AG OTRSCIsInCustomerFrontend Permission License and Access Control Issues Vulnerability

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A privilege permission and access control issue vulnerability exists in OTRS AG OTRSCIsInCustomerFrontend, which stems from an agent being able to view and...

Talkin’ SMAC: Alert Labeling and Why It Matters

If you’ve ever worked in a Security Operations Center SOC, you know that it’s a special place. Among other things, the SOC is a massive data-labeling machine, and generates some of the most valuable data in the cybersecurity industry. Unfortunately, much of this valuable data is often rendered...

CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

Code injection

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

UBUNTU-CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

CVE-2021-21436

CVE-2021-21436 affects OTRS AG OTRSCIsInCustomerFrontend 7.0.x, specifically version 7.0.14 and earlier. The vulnerability allows agents to see and link Config Items without the required permissions, as defined in General Catalog. The root cause is insufficient access control for configuration it...

OTRS AG OTRSCIsInCustomerFrontend 权限许可和访问控制问题漏洞

OTRS AG OTRSCIsInCustomerFrontend is a management system from OTRS USA. It provides modern, flexible ticket and process management services. A privilege permission and access control issue vulnerability exists in OTRS AG OTRSCIsInCustomerFrontend, which stems from an agent being able to view and...

Design/Logic Flaw

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...