513 matches found
PT-2021-4061 · Ruby +1 · Action Pack +1
Name of the Vulnerable Software and Affected Versions: actionpack ruby gem versions 6.0.0 through 6.0.3.6 actionpack ruby gem versions 6.1.0 through 6.1.3.1 Description: The issue is related to a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafte...
Possible Open Redirect in Host Authorization Middleware
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22881. Versions Affected: = 6.0.0 Not affected: a-z0-9.-+|\a-f0-9:a-f0-9.:+\ :\d+? \z /x originhost = validhost.match...
GHSA-49R3-2549-3633 omniauth-apple allows attacker to fake their email address during authentication
Impact This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other...
Cloudbees Jenkins Chaos Monkey Plugin Authorization Issue Vulnerability (CNVD-2020-70261)
Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...
Cloudbees Jenkins Chaos Monkey Plugin Authorization Issues Vulnerability
Cloudbees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . CVS Plugin is used in one of the CVS versi...
CVE-2020-2322
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks...
CVE-2020-2322
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
Design/Logic Flaw
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
Design/Logic Flaw
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks...
CVE-2020-2323
Summary: Jenkins Chaos Monkey Plugin 0.4 and earlier lacks permission checks on an HTTP endpoint. This allows attackers with Overall/Read to access the Chaos Monkey page and view action history. Mitigation: Upgrade to version 0.4.1 or later, which requires Overall/Administer permission to access ...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
CVE-2020-2322
Affected software : Jenkins Chaos Monkey Plugin (versions 0.3 and earlier). Root cause : several HTTP endpoints do not perform permission checks. Impact : enables attackers with Overall/Read permission to generate load and memory leaks. Evidence : CVE-2020-2322 and connected advisories describe t...
CVE-2020-2322
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks...
Cloudbees Jenkins 授权问题漏洞
Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...
PT-2020-15557 · Jenkins · Jenkins Chaos Monkey Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Chaos Monkey Plugin versions 0.4 and earlier Description: The issue allows attackers with Overall/Read permission to access the Chaos Monkey page and see the history of actions due to a lack of permission checks in an HTTP endpoint...
PT-2020-15556 · Jenkins · Jenkins Chaos Monkey Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Chaos Monkey Plugin versions 0.3 and earlier Description: The issue concerns the Jenkins Chaos Monkey Plugin, where several HTTP endpoints do not perform permission checks. This allows attackers with Overall/Read permission to generat...
Cloudbees Jenkins 授权问题漏洞
Cloudbees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . CVS Plugin is used in one of the CVS versi...
monkey-r.com Cross Site Scripting vulnerability OBB-1440080
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...