Jenkins user enumeration vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a user enumeration vulnerability that stems from an observable time difference between a valid user a...

GHSA-JHFV-8936-G652 Cross-site Scripting in Jenkins Hidden Parameter Plugin

Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Exploitation of this...

Unauthorized view fragment access in Jenkins

Jenkins uses the Stapler web framework to render its UI views. These views are frequently composed of several view fragments, enabling plugins to extend existing views with more content. Before SECURITY-534 was fixed in Jenkins 2.186 and LTS 2.176.2, attackers could in some cases directly access ...

Jenkins 2.335 < 2.356 Information Disclosure Vulnerability (SECURITY-2777) - Linux

Jenkins is prone to an information disclosure vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

AZL-43477 CVE-2022-29526 affecting package containernetworking-plugins 1.1.1-17

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

AZL-45294 CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

Malicious Package

Overview cxf-plugins is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

LaikeTui 代码问题漏洞

LaikeTui Laike e-commerce is a stable and small open source mall system for individual developers. LaikeTui 3.5.0 version of a security vulnerability , the vulnerability stems from any file upload can exist in the background plug-ins , attackers can use the vulnerability to execute arbitrary code...

MAL-2022-7200 Malicious code in wm-plugins-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d71d93b59b13c9e104289423006a7840efc7c6e11c15743f9c74c7669e712cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wm-plugins-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d71d93b59b13c9e104289423006a7840efc7c6e11c15743f9c74c7669e712cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2047 Malicious code in com.outsystems.plugins.fileviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e48c3e2dce6b01b3a80e3284dea055908e7c232a4f9fa11407fd851f4c0ecc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rcv-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ceeb2a3bf3b825a99df7d1a8e948a2e3b138496ee05f01669e84fabc97f836b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-viewer-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e88819999c0d345307d6463d7b8df1f10b2bfe74e24e06c8fca6397f247d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5794 Malicious code in ricos-viewer-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e88819999c0d345307d6463d7b8df1f10b2bfe74e24e06c8fca6397f247d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-editor-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aa4fc05d5690e1531b5c6ded8da6d238b6f9dc653ed7abd654f5159e697dc20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5792 Malicious code in ricos-editor-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aa4fc05d5690e1531b5c6ded8da6d238b6f9dc653ed7abd654f5159e697dc20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rcv-with-media-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b87bcd5714bceeaac4632e986592400170fa242770fd2f93acac611c3a15726f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5615 Malicious code in rcv-with-media-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b87bcd5714bceeaac4632e986592400170fa242770fd2f93acac611c3a15726f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5369 Malicious code in plugin-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e9672c1d10cc9e8ae7d898f3b96987d487c768b9ddbcecb7159af7cf1697f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in plugin-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e9672c1d10cc9e8ae7d898f3b96987d487c768b9ddbcecb7159af7cf1697f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...