1306 matches found
GSD-2022-1002658 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
coresight: cpu-debug: Replace mutex with mutextrylock on panic notifier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...
MAL-2022-526 Malicious code in @primeo/notifier (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a51b35e86abf2d2fc11c572f2372c900eeb33cd05bed616fa0a3071979193bde Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in slack-notifier-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6159 Malicious code in slack-notifier-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 808c04da5449cf52c62a74f07d423906be15af0d636700e95bae64f37cc069c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SUSE-SU-2022:1939-1 Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP4)
This update for the Linux Kernel 4.12.14-9588 fixes several issues. The following security issues were fixed: - CVE-2022-1048: Fixed a race Condition in sndpcmhwfree leading to use-after-free due to the AB/BA lock with buffermutex and mmaplock bsc1197597. - CVE-2022-30594: Fixed restriction bypas...
PT-2022-3650 · Red Hat · Red Hat Advanced Cluster Security For Kubernetes
Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description: A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes, related to insufficient protection of service data in the GraphQL API. Thi...
Red Hat stackrox 安全漏洞
Red Hat stackrox is a full lifecycle Kubernetes security solution from Red Hat. It allows you to detect, manage, and mitigate security risks, such as misconfigurations, and vulnerabilities CVEs. A security vulnerability exists in Red Hat stackrox that stems from improper stackrox cleanup. An...
Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin
Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the...
GHSA-826H-FXFF-HPQF Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials
Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is...
Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials
Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is...
Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.snsnotify.AmazonSNSNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...
GHSA-84P4-7MXC-7PHJ Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.snsnotify.AmazonSNSNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...
Jenkins RocketChat Notifier Plugin Licensing Issue Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins RocketChat Notifier Plugin 1.4.10 and earlier versions are vulnerable...
Jenkins RocketChat Notifier Plugin跨站请求伪造漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins RocketChat Notifier Plugin 1.4.10...
Missing permission check in Jenkins RocketChat Notifier Plugin
Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additionally, this form validation...
CSRF vulnerability in Jenkins RocketChat Notifier Plugin
Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential. Additionally, this form validation...
GHSA-X25H-F84X-WH4M CSRF vulnerability in Jenkins RocketChat Notifier Plugin
Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential. Additionally, this form validation...
CVE-2022-28138
A cross-site request forgery CSRF vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential...
CVE-2022-28139
A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...
