CVE-2022-25171

The package p4 before 0.0.7 are vulnerable to Command Injection via the run function due to improper input sanitization...

Command injection

The package p4 before 0.0.7 are vulnerable to Command Injection via the run function due to improper input sanitization...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the run function due to improper input sanitization PoC javascript var root = require"p4" root.run"& touch JHU","",function Remediation Upgrade p4 to version 0.0.7 or higher. References - GitHub Commit - Vulnerable...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.15, <=2.16), org.jenkins-ci.plugins:p4 (>=1.7.6, <=1.8.15) potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.32)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.15, =1.7.6,...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.15, <=2.16), org.jenkins-ci.plugins:p4 (>=1.7.6, <=1.8.15) potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins.workflow:workflow-cps (2.32)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.15, =1.7.6,...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.15, <=2.16), org.jenkins-ci.plugins:p4 (>=1.7.6, <=1.8.15) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.32)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.15, =1.7.6,...

CSRF vulnerability in Jenkins P4 Plugin

A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce...

Missing permission checks in Jenkins P4 Plugin

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints...

GHSA-F9V6-P7HP-C3QX Missing permission checks in Jenkins P4 Plugin

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints...

GHSA-RJJQ-63C7-8724 CSRF vulnerability in Jenkins P4 Plugin

A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce...

org.jenkins-ci.plugins:bitbucket-approve (>=1.0.1, <=1.0.3), org.jenkins-ci.plugins:git (>=2.2.10, <=2.3.2) +1 more potentially affected by CVE-2019-10320 via org.jenkins-ci.plugins:credentials (1.19)

org.jenkins-ci.plugins:credentials MAVEN version 1.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:bitbucket-approve =1.0.1, =2.2.10, =1.1.0, =1.1.4 Source cves:...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.15, <=2.16), org.jenkins-ci.plugins:p4 (>=1.7.6, <=1.8.15) potentially affected by CVE-2022-30945 via org.jenkins-ci.plugins.workflow:workflow-cps (2.32)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.15, =1.7.6,...

Cross-Site Request Forgery in Jenkins P4 Plugin

A cross-site request forgery CSRF vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password. Jenkins P4 Plugin 1.11.5 requires POST requests for the affected HTTP endpoints...

GHSA-3RJ3-QP2J-4FJ2 Cross-Site Request Forgery in Jenkins P4 Plugin

A cross-site request forgery CSRF vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password. Jenkins P4 Plugin 1.11.5 requires POST requests for the affected HTTP endpoints...

p4.design Cross Site Scripting vulnerability OBB-2364060

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ISC BIND DoS Vulnerability (CVE-2016-2088)

ISC BIND is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2020-25925

Cross Site Scripting XSS in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field...

CVE-2020-25925: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field...

PT-2021-11204

Name of the Vulnerable Software and Affected Versions: IceWarp WebClient version 10.3.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the p4 field in the Webmail Calendar, potentially leading to Cross Site Scripting XSS attacks. Recommendations: For...

GHSA-H6QV-F5GF-8GCF Missing Authorization in Jenkins P4 plugin

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password. Jenkins P4 Plugin 1.11.5 requires...