3843 matches found
PT-2017-10794
Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Build Step Plugin affected versions not specified Description The issue concerns the Pipeline: Build Step Plugin in Jenkins, where builds are associated with an authentication controlling permissions for interactions with oth...
PT-2017-10801
Name of the Vulnerable Software and Affected Versions Jenkins affected versions not specified Description The issue allows for arbitrary code execution due to incomplete sandbox protection in Pipeline scripts. Specifically, constructors, instance variable initializers, and instance initializers...
PT-2017-10813
Name of the Vulnerable Software and Affected Versions Jenkins versions affected versions not specified Description The issue concerns the Pipeline: Input Step Plugin, which previously allowed users with Item/Read access to interact with the step. This has been changed to require Item/Build...
jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433)
The jenkins-plugin-pipeline-build-step fails to check permissions correctly allowing attackers with access to it to specify the triggering of any other project in Jenkins. This potentially gives an attacker access to projects they should not have access to...
jenkins-plugin-workflow-cps: Arbitrary code execution due to incomplete sandbox protection (SECURITY-551)
The jenkins-plugin-script-security has incomplete sandbox protection which allows attackers to execute arbitrary code via constructors, instance variable initializers, and instance initializers in Pipeline scripts. Exploitation of this requires the attacker to have permission to configure Pipelin...
CVE-2017-1000108
The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...
Wallarm at NGINX.conf
Wallarm is proud to be a gold sponsor of NGINX 2017. nginx.conf is an annual conference for technical professionals who are passionate about delivering better application and web performance. The event takes place on September 6–8 at the Nines Luxury Hotel in Portland, OR. Join us at the...
CloudBees Jenkins Pipeline: Groovy Plugin Remote Code Execution Vulnerability
CloudBees Jenkins Pipeline: Groovy Plugin is a U.S. CloudBees company's Java-based development of continuous integration tools in the process of building plug-ins . A remote code execution vulnerability exists in CloudBees Jenkins Pipeline: Groovy Plugin versions 2.36 and earlier. A remote attack...
CVE-2017-1000096
The jenkins-plugin-script-security has incomplete sandbox protection which allows attackers to execute arbitrary code via constructors, instance variable initializers, and instance initializers in Pipeline scripts. Exploitation of this requires the attacker to have permission to configure Pipelin...
CVE-2017-1000089
The jenkins-plugin-pipeline-build-step fails to check permissions correctly allowing attackers with access to it to specify the triggering of any other project in Jenkins. This potentially gives an attacker access to projects they should not have access to...
Hehdirb
Выложил недавно поделие для пайплайн-дирбастинга. Ссылка: В силу криворукости правильно обрабатываю не все эксепшны и не очень правильно работаю с gevent, но в таком виде на многих хостах тоже выжимает сильно больше, чем обычный dirbuster. Тулза может сама бинарным поиском определить максимальное...
CloudBees Jenkins Pipeline: Classpath Steps Plugin Security Bypass Vulnerability
CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools . A security vulnerability in the CloudBees Jenkins Pipeline: Classpath Steps plugin allows remote attackers to submit a special request to bypass security restrictions and...
CVE-2017-2602
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents SECURITY-358...
Glue - Application Security Automation
Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools. Recommended Usage For those wishing to run Glue, we recommend using the docker image because it should have the other tools it uses available already an...
Cross-Site Scripting (XSS)
html-pipeline is vulnerable to cross-site scripting XSS attacks. The sanitization filter whitelists table elements, allowing a malicious user to inject and execute arbitrary scripts...
Threat Outbreak Alert RuleID24710: Email Messages Distributing Malicious Software on August 30, 2016
Medium Alert ID: 48673 First Published: 2016 August 30 18:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24710 may contain the following files: Name |...
Symantec Embedded Security:Critical System Protection and Symantec Data Center Security: Server Advanced Security Bypass Vulnerabilities
Symantec Embedded Security:Critical System Protection SES:CSP and Symantec Data Center Security: Server Advanced SDCS:SA are both security products from Symantec Corporation. SES:CSP is a lightweight intrusion detection and prevention system client product; SDCS:SA provides security for physical...
Clair - Vulnerability Static Analysis for Containers
Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...
CVE-2016-1653
The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation, related...
