Design/Logic Flaw

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

5 Tips for Protecting Your Phone from Malware

By Deeba Ahmed Most people today depend on their phones entirely. Aside from being a portal to our social life, they… This is a post from HackRead.com Read the original post: 5 Tips for Protecting Your Phone from Malware...

Full Read SSRF in Mobile Plugin CVE-2022-26135

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Jira Management Server and Data Center versions from versi...

CVE-2022-34201

A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

CVE-2022-34201

The connected documents confirm CVE-2022-34201 affects Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier, caused by a missing permission check in a form-validation method, enabling attackers with Overall/Read to connect to an attacker-specified URL (CSRF risk noted). As of publication, th...

CVE-2022-34200

The CVE-2022-34200 issue affects Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier. It is a CSRF vulnerability in a form-validation method that allows an attacker with Overall/Read permission to connect to an attacker-specified URL, and the vulnerability can be triggered without POST cons...

CVE-2022-34200

A cross-site request forgery CSRF vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL...

CVE-2022-34199

CVE-2022-34199 concerns the Jenkins Convertigo Mobile Platform Plugin (version 1.1 and earlier). The vulnerability arises because passwords are stored unencrypted in the plugin’s configuration files (job config.xml) on the Jenkins controller, making them viewable by users with Extended Read permi...

CVE-2022-34199

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

mobilehealth.com Cross Site Scripting vulnerability OBB-2663573

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of iRZ mobile router microprogramming software, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.

The vulnerability of iRZ mobile router microprogramming software is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

PT-2022-22068 · Jenkins · Jenkins Convertigo Mobile Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Convertigo Mobile Platform Plugin versions 1.1 and earlier Description: The issue allows passwords to be stored unencrypted in job config.xml files on the Jenkins controller. This can be viewed by users with Extended Read permission o...

PT-2022-22070 · Jenkins · Jenkins Convertigo Mobile Platform Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Convertigo Mobile Platform Plugin versions 1.1 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL. Recommendations: For Jenkins Convertigo Mobile Platform Plugin versio...

Jenkins Plugin Convertigo Mobile Platform 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from a failure to perform permission checks in the...

Mitigate Ransomware in a Remote-First World

Ransomware has been a thorn in the side of cybersecurity teams for years. With the move to remote and hybrid work, this insidious threat has become even more of a challenge for organizations everywhere. 2021 was a case study in ransomware due to the wide variety of attacks, significant financial...

Hyland Onbase Application Server 安全漏洞

Hyland Onbase Application Server is an enterprise information platform server from Hyland USA. Designed to manage content, processes and cases. A security vulnerability exists in Hyland Onbase Application Server versions prior to 20.3.58.1000 and Onbase versions 21.1.1.1000 through 21.1.15.1000. ...

Malicious code in mattermost-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 559bbd230a61f27a67472272f7ad0d54492d8e9f0fe8245c3c67aa9987efd1d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4500 Malicious code in mattermost-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 559bbd230a61f27a67472272f7ad0d54492d8e9f0fe8245c3c67aa9987efd1d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mattermost-mobile-e2e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1307116dedf590909799162cf8b3c892665ef1f1e6c9301aa3ae7c7dae92e04f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4501 Malicious code in mattermost-mobile-e2e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1307116dedf590909799162cf8b3c892665ef1f1e6c9301aa3ae7c7dae92e04f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...