mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries

MariaDB through 10.5.9 allows a setvar.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2021-21687 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

GHSA-5WC4-W63V-97C3 XXE vulnerability in Jenkins Nested View Plugin

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity XXE attacks. This allows attackers able to configure views to have Jenkins parse a crafted view XML definition that uses external entities for extraction of secrets from the Jenkins...

XXE vulnerability in Jenkins Nested View Plugin

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity XXE attacks. This allows attackers able to configure views to have Jenkins parse a crafted view XML definition that uses external entities for extraction of secrets from the Jenkins...

GHSA-96JW-3XW4-MQ9P Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items

Items like jobs can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well. Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly perform permission checks to...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2020-2222 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2019-10352 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

Allocation of Resources Without Limits or Throttling

Overview std/regexp is a Go standard library package std/regexp Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine...

PT-2022-20526

Name of the Vulnerable Software and Affected Versions rulex versions prior to 0.4.3 Description The issue arises when parsing untrusted rulex expressions, which can cause a stack overflow and potentially enable a Denial of Service attack. This occurs when an expression has several hundred levels ...

Mozilla: Bypassing permission prompt in nested browsing contexts

The Mozilla Foundation Security Advisory describes this flaw as: Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions...

Mozilla: Bypassing permission prompt in nested browsing contexts

The Mozilla Foundation Security Advisory describes this flaw as: Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions...

com.deepshiftlabs.nerrvana:nerrvana-plugin (>=1.02.03, <=1.02.05), net.praqma:drmemory-plugin (>=0.1.0, <=0.1.1) +11 more potentially affected by CVE-2017-1000356 via org.jenkins-ci.main:jenkins-core (1.450)

org.jenkins-ci.main:jenkins-core MAVEN version 1.450 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.deepshiftlabs.nerrvana:nerrvana-plugin =1.02.03, =0.1.0, =1.0, =0.3, =1.02r, =1.10, =1.3,...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2018-1000170 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2017-1000395 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

com.deepshiftlabs.nerrvana:nerrvana-plugin (>=1.02.03, <=1.02.05), net.praqma:drmemory-plugin (>=0.1.0, <=0.1.1) +11 more potentially affected by CVE-2017-1000395 via org.jenkins-ci.main:jenkins-core (1.450)

org.jenkins-ci.main:jenkins-core MAVEN version 1.450 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.deepshiftlabs.nerrvana:nerrvana-plugin =1.02.03, =0.1.0, =1.0, =0.3, =1.02r, =1.10, =1.3,...

javagh.jenkins:mashup-portlets-plugin (>=0.9, <=1.0.3), org.jenkins-ci.main:jenkins-test-harness (1.526) +10 more potentially affected by CVE-2017-1000398 via org.jenkins-ci.main:jenkins-core (1.526)

org.jenkins-ci.main:jenkins-core MAVEN version 1.526 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - javagh.jenkins:mashup-portlets-plugin =0.9, =4.2.2, =1.0.1, =1.12, =1.526, =0.5, =1.4, =1.9.1...

Incorrect Default Permissions in Supervisor

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...

jackson-databind: denial of service via a large depth of nested objects

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

SEV-SNP Disclosure

The vulnerability of the SEV-SNP secure nested paging implementation for virtual machines running on AMD processor-based servers is related to data encryption errors. Exploiting this vulnerability can allow attackers to disclose sensitive information by launching attacks through secondary channel...

Akka HTTP 10.1.14 - Denial of Service

Exploit Title: Akka HTTP Denial of Service via Nested Header Comments Date: 18/4/2022 Exploit Author: cxosmo Vendor Homepage: https://akka.io Software Link: https://github.com/akka/akka-http Version: Akka HTTP 10.1.x 10.1.15 & 10.2.x 10.2.7 Tested on: Akka HTTP 10.2.4, Ubuntu CVE : CVE-2021-42697...