jenkins-cve-2016-0792

Jenkins CVE-2016-0792 Exploit for Jenkins serialization vulnerability - CVE-2016-0792 Exploit database https://www.exploit-db.com/exploits/42394/ More information can be found here 1. Contrast Security 2. Pentester Lab Requirements 1. Python 3.6.x 2. requests library is required for this exploit ...

jenkins-cve-2016-0792

Jenkins CVE-2016-0792 Exploit per la vulnerabilità di serializzazione di Jenkins - CVE-2016-0792 Database exploit https://www.exploit-db.com/exploits/42394/ Maggiori informazioni sono disponibili qui 1. Contrast Security 2. Pentester Lab Requisiti 1. Python 3.6.x 2. La libreria requests è...

cred_scanner

credscanner A simple command line tool for finding AWS credentials in files. Optimized for use with Jenkins and other CI systems. I suspect there are other, better tools out there such as git-secrets, but I couldn't find anything to run a quick and dirty scan that also integrates well with Jenkin...

cred_scanner

credscanner Un semplice strumento da riga di comando per trovare credenziali AWS nei file. Ottimizzato per l'uso con Jenkins e altri sistemi CI. Sospetto che esistano altri strumenti migliori come git-secrets, ma non ho trovato nulla per eseguire una scansione rapida e sporca che si integri bene...

zaproxy

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 – Schwachstelle zum Lesen beliebiger Dateien über die CLI kann zu RCE führen Betroffene Produkte und Versionen: Produkt| Betroffene Versionen ---|--- Jenkis Server| = 2.441 = LTS 2.426.3 CVSS: KRITISCH Aktiv ausgenutzt: JA Patch: JA Gegenmaßnahmen: JA Hilfe...

Jenkins-CVE-2015-8103

Jenkins-CVE-2015-8103...

CVE-2024-52550

CVE-2024-52550 CVE-2024-52550 jenkins tester o PoC...

CVE-2024-43044-jenkins-creds

Einführung Dies ist ein Exploit für CVE-2024-43044, ein beliebiges Dateilesen, das es einem Agenten ermöglicht, Dateien vom Controller abzurufen. Der Exploit wird die Schwachstelle nutzen, um die Datei credentials.xml zu lesen und geheime Schlüssel zu erhalten, mit denen sie entschlüsselt wird...

jenkinsci__perfecto-plugin_CVE-2020-2261_1-17

Plugin Perfecto Jenkins Il Plugin Perfecto Jenkins offre la possibilità di creare automaticamente/riutilizzare il tunnel-id esistente di Perfecto Connect nell'ambiente di build. Indice Plugin Perfecto Jenkins Indice Prerequisiti 1. Passaggi per abilitare il plugin Screenshot Mac Windows Opzioni...

CVE-2024-25897

parâmetros ip , puerto , ruta saída do exploit Painel de ajuda explicação do exploit Aqui está a explicação do código em Markdown: Explicação do Código Este script foi projetado para explorar uma vulnerabilidade específica no Jenkins CVE-2024-23897. Ele permite baixar um arquivo JAR de um servido...

CVE2_Jenkins_RCE

Dirottamento WebSocket della CLI di Jenkins - PoC Un exploit proof-of-concept di dirottamento WebSocket cross-site per CVE-2024-23898 — una vulnerabilità che interessa le versioni di Jenkins 2.217-2.441. Questo exploit prende di mira la CLI di Jenkins, che può essere utilizzata per accedere e...

Jenkin Audit Trail <=3.2 - Cross-Site Scripting

Jenkins Audit Trail 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2140 info: name: Jenkin Audit Trail =3.3 which includes a fix for this vulnerability. reference: -...

Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting

Jenkins Gitlab Hook 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2096 info: name: Jenkins Gitlab Hook =1.4.3 to mitigate this vulnerability. reference: -...

Jenkins <=2.218 - Information Disclosure

Jenkins through 2.218, LTS 2.204.1 and earlier, is susceptible to information disclosure. An attacker can access exposed session identifiers on a user detail object in the whoAmI diagnostic page and thus potentially access sensitive information, modify data, and/or execute unauthorized operations...

Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. id: CVE-2018-1000600...

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

Jenkins - Remote Command Injection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

Jenkins Pipeline: Groovy Plugin workflow-cps version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with...