PT-2022-22429

Name of the Vulnerable Software and Affected Versions Parallels Access version 6.5.4 39316 Agent Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

Parallels Access Agent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Desktop...

Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers

A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible token...

Jenkins user enumeration vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a user enumeration vulnerability that stems from an observable time difference between a valid user a...

The vulnerability of PDF browser plugins for Google Chrome and Microsoft Edge allows attackers to disclose protected information.

The vulnerability of PDF browser plugins for Google Chrome and Microsoft Edge is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to disclose protected information through a specially created web page...

GHSA-JHFV-8936-G652 Cross-site Scripting in Jenkins Hidden Parameter Plugin

Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Exploitation of this...

Unauthorized view fragment access in Jenkins

Jenkins uses the Stapler web framework to render its UI views. These views are frequently composed of several view fragments, enabling plugins to extend existing views with more content. Before SECURITY-534 was fixed in Jenkins 2.186 and LTS 2.176.2, attackers could in some cases directly access ...

Jenkins 2.335 < 2.356 Information Disclosure Vulnerability (SECURITY-2777) - Linux

Jenkins is prone to an information disclosure vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

AZL-43477 CVE-2022-29526 affecting package containernetworking-plugins 1.1.1-17

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

AZL-45294 CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

Malicious Package

Overview cxf-plugins is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

LaikeTui 代码问题漏洞

LaikeTui Laike e-commerce is a stable and small open source mall system for individual developers. LaikeTui 3.5.0 version of a security vulnerability , the vulnerability stems from any file upload can exist in the background plug-ins , attackers can use the vulnerability to execute arbitrary code...

Stored XSS vulnerabilities in multiple plugins providing additional parameter types

Multiple plugins do not escape the name and description of the parameter types they provide: Agent Server Parameter 1.1 and earlier SECURITY-2731 / CVE-2022-34183 CRX Content Package Deployer 1.9 and earlier SECURITY-2727 / CVE-2022-34184 Date Parameter Plugin 0.0.4 and earlier SECURITY-2711 /...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +230 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (>=1.0, <=1.29)

org.jenkins-ci.plugins:junit MAVEN version =1.0, =1.0.5.0, =0.2, =1.9.2-beta, =1.28.0, =2.37.0, =1.7.2, =1.1.2, =1.2.5, =1.1, =1.0.22, =2.2, =2.20 and more Source cves: CVE-2022-34176 Source advisory: MEND:CVE-2022-34176...

Malicious code in wm-plugins-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d71d93b59b13c9e104289423006a7840efc7c6e11c15743f9c74c7669e712cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7200 Malicious code in wm-plugins-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d71d93b59b13c9e104289423006a7840efc7c6e11c15743f9c74c7669e712cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2047 Malicious code in com.outsystems.plugins.fileviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e48c3e2dce6b01b3a80e3284dea055908e7c232a4f9fa11407fd851f4c0ecc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rcv-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ceeb2a3bf3b825a99df7d1a8e948a2e3b138496ee05f01669e84fabc97f836b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-editor-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9aa4fc05d5690e1531b5c6ded8da6d238b6f9dc653ed7abd654f5159e697dc20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-viewer-with-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e88819999c0d345307d6463d7b8df1f10b2bfe74e24e06c8fca6397f247d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...