CVE-2022-29047

CVE-2022-29047 affects Jenkins Pipeline: Shared Groovy Libraries Plugin (versions 564.ve62a_4eb_b_e039 and earlier, except 2.21.3). The vulnerability allows attackers who can submit pull requests (but cannot commit to SCM) to change the definition of a dynamically retrieved library, effectively a...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

April 12, 2022-KB5012121 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 11

None None...

April 12, 2022-KB5012120 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1909

None None...

PT-2022-19387 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Shared Groovy Libraries Plugin versions 564.ve62a 4eb b e039 and earlier, except version 2.21.3 Description: The issue allows attackers who can submit pull requests, but not commit directly to the configured SCM, to change t...

Untrusted users can modify some Pipeline libraries in workflow-cps-global-lib

Multibranch Pipelines by default limit who can change the Pipeline definition from the Jenkinsfile. This is useful for SCMs like GitHub: Jenkins can build content from users without commit access, but who can submit pull requests, without granting them the ability to modify the Pipeline definitio...

Jenkins Pipeline访问控制错误漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Pipeline is a suite of plugins that support the implementation and integration of continuous delivery pipelines int...

CVE-2022-29047: Incorrect Authorization

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

Security Bulletin: Cúram Social Program Management may be affected by Denial of Service vulnerability in Google Gson (217225)

Summary IBM Cúram Social Program Management uses the Google Gson libraries, for which there is a publicly known vulnerability. For this vulnerability Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace method, a remote attacker cou...

Oracle Java SE Libraries Partial DoS

The vulnerability of the Libraries component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause partial service interruptions...

Oracle Java SE Libraries Partial DoS

The vulnerability of the Libraries component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause partial service interruptions...

[SECURITY] Fedora 36 Update: openssl1.1-1.1.1n-1.fc36

The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases...

radare2 out-of-bounds read vulnerability

radare2 is a set of libraries and tools for working with binary files. radare2 versions prior to 5.6.8 contain an out-of-bounds read vulnerability that can be exploited by attackers to read sensitive information from outside the allocated buffer boundary...

Amazon Corretto Java 8.x < 8.242.07.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.242.07.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2020-Jan-14 advisory. - OpenJFX libxslt CVE-2019-13117, CVE-2019-13118 - OpenJFX SQLite CVE-2019-16168 - Serialization...

Amazon Corretto Java 11.x < 11.0.5.10.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 11 11.0.5.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2019-Oct-15 advisory. - security-libs/javax.net.ssl CVE-2019-2894, CVE-2019-2949 - core-libs CVE-2019-2933 -...

Amazon Corretto Java 11.x < 11.0.6.10.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 11 11.0.6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2020-Jan-15 advisory. - Serialization CVE-2020-2583, CVE-2020-2604 - Security CVE-2020-2590, CVE-2020-2601 - Networking...

Vulnerabilities fixed in IBM QRadar

IBM has fixed vulnerabilities in QRadar. The vulnerabilities are in underlying software and libraries, such as the Linux kernel used, OpenSSL, Bash, OpenSSH, Kerberos and Mozilla software. A malicious party could exploit the vulnerabilities to causing a denial-of-service, executing arbitrary code...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +15165 more potentially affected by CVE-2022-22965 via org.springframework:spring-beans (>=5.3.0, <=5.3.17)

org.springframework:spring-beans MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

AttacheCase may insecurely load Dynamic Link Libraries

Overview AttacheCase may insecurely load Dynamic Link Libraries. AttacheCase is an open source file encryption software provided by HiBARA Software. AttacheCase contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Taizoh Tsukamoto of...