at.researchstudio.sat:won-owner-webapp (=0.3), at.researchstudio.sat:won-utils-mail (>=0.2 <=0.9) +1394 more potentially affected by CVE-2017-9801 via org.apache.commons:commons-email (>=1.1 <=1.4)

org.apache.commons:commons-email MAVEN version =1.1, =0.2, =1.0.0, =1.2.8, =1.0.2, =1.2, =1.0.0, =1.0.1, =0.0.1, =2.23.0, =1.1, =1.4 and more Source cves: CVE-2017-9801 Source advisory: OSV:GHSA-P7VM-PHXX-G722...

Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery

Jenkins Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy acti...

GHSA-FV3C-6CW7-2QCQ Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery

Jenkins Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy acti...

Jenkins Git Plugin 信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

Jenkins REPO Plugin 信息泄露漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application software.Jenkins REPO Plugin 1.14.0 and...

Google Created 'Open Source Maintenance Crew' to Help Secure Critical Projects

Google on Thursday announced the creation of a new "Open Source Maintenance Crew" to focus on bolstering the security of critical open source projects. Additionally, the tech giant pointed out Open Source Insights as a tool for analyzing packages and their dependency graphs, using it to determine...

au.com.turingg:turingg-files (=0.0.1), au.com.turingg:turingg-mimak (=1.0.0) +65 more potentially affected by CVE-2018-8036 via org.apache.pdfbox:pdfbox (>=2.0.1 <=2.0.10)

org.apache.pdfbox:pdfbox MAVEN version =2.0.1, =1.0.0, =1.2, =0.9.2, =2.6.1, =2.6.2 - com.norconex.collectors:norconex-importer =2.6.1 - de.redsix:pdfcompare =1.1.32 - edu.usc.ir:sentiment-analysis-parser =0.1 - fr.pilato.elasticsearch.crawler:fscrawler =2.1 - io.bigconnect:dw-mime-type-detector...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2 <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21 <=2.0.2) +231 more potentially affected by CVE-2017-7561 via org.jboss.resteasy:resteasy-jaxrs (=3.1.4.Final)

org.jboss.resteasy:resteasy-jaxrs MAVEN version =3.1.4.Final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - ca.ibodrov.concord:testcontainers-concord =0.0.2, =0.0.21, =0.0.2, =0.0.1, =1.0.6.Fina...

ch.digitalfondue.stampo:ch.digitalfondue.stampo.gradle.plugin (=0.0.3), ch.digitalfondue.stampo:stampo (>=1.0 <=1.2.1) +837 more potentially affected by CVE-2017-12165 via io.undertow:undertow-core (>=1.0.0.Alpha1 <=1.3.30.Final)

io.undertow:undertow-core MAVEN version =1.0.0.Alpha1, =1.0, =1.0, =0.1.0, =0.2.0, =1.1.11, =1.1.11, =1.1.16, =1.1.0, =0.0.8, =0.0.8, =0.1.0, =0.0.6, =0.1.3 and more Source cves: CVE-2017-12165 Source advisory: OSV:GHSA-5GG7-5WV8-4GCJ...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2 <=0.0.13), ca.vanzyl.concord:concord-k8s-server (>=0.0.1 <=0.0.10) +16 more potentially affected by CVE-2018-1051 via org.jboss.resteasy:resteasy-yaml-provider (>=3.1.0.Beta1 <=3.6.0.CR1)

org.jboss.resteasy:resteasy-yaml-provider MAVEN version =3.1.0.Beta1, =0.0.2, =0.0.1, =0.0.8, =1.18.0, =1.38.0, =1.44.0, =1.37.0, =1.44.0, =1.0.0, =1.18.0, =1.0.0, =1.0.0, =0.0.27, =0.0.11, =0.0.27, =0.0.31 and more Source cves: CVE-2018-1051 Source advisory: OSV:GHSA-M2FV-3RQM-G7P5...

br.eti.clairton:ds-test (=0.4.0), br.jus.stf.digital:core (>=2.0.0 <=2.3.1) +1329 more potentially affected by CVE-2018-1114 via io.undertow:undertow-core (>=1.0.0.Alpha1 <=1.4.24.Final)

io.undertow:undertow-core MAVEN version =1.0.0.Alpha1, =2.0.0, =1.0, =1.0, =0.2.7, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.2.0, =1.1.11, =1.3.7 and more Source cves: CVE-2018-1114 Source advisory: OSV:GHSA-GJJX-GQM4-WCGM...

GHSA-P8X8-P473-MMMV Missing Authorization in Jenkins

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/job-name/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and...

br.eti.clairton:ds-test (>=0.4.0 <=1.2.1), br.jus.stf.digital:core (>=2.0.0 <=2.3.1) +1669 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (>=1.0.0.Alpha1 <=2.0.18.Final)

io.undertow:undertow-core MAVEN version =1.0.0.Alpha1, =0.4.0, =2.0.0, =1.0, =1.0, =3.0.0.RELEASE, =0.0.1-jdk1.8-RELEASES, =0.0.1-jdk1.8-RELEASES, =0.1.4-jdk1.8-RELEASES, =0.0.4, =0.2.7, =0.0.1, =0.0.1, =1.0.1.U1 and more Source cves: CVE-2018-14642 Source advisory: OSV:GHSA-VF6R-MMHC-3XCM...

br.net.woodstock.rockframework:rockframework-web (>=1.2.1 <=1.2.2), com.cybersource:cybersource-sdk-java (>=6.0.1 <=6.1.0) +333 more potentially affected by CVE-2014-3623 via org.apache.ws.security:wss4j (>=1.5.2 <=1.6.16)

org.apache.ws.security:wss4j MAVEN version =1.5.2, =1.2.1, =6.0.1, =1.0, =1.0.1, =1.1.0.Beta5, =1.1.0.Beta5, =1.1.0.Beta5, =1.1.0.Beta1, =1.0.0, =1.2.0 and more Source cves: CVE-2014-3623 Source advisory: OSV:GHSA-99V3-9X35-C5VF...

cn.acooly:acooly-auth-wechat-authenticator (=5.2.1), cn.org.thinkcloud:think-cloud-starter-id (=2.0.1.RELEASE) +467 more potentially affected by CVE-2018-8012 via org.apache.zookeeper:zookeeper (>=3.5.0-alpha <=3.5.3-beta)

org.apache.zookeeper:zookeeper MAVEN version =3.5.0-alpha, =3.2.0, =3.0.5, =3.0.5, =0.85, =3.2.0, =3.2.0, =3.3.0-RELEASE, =0.2.2, =0.1.2, =0.2.0, =0.2.1 and more Source cves: CVE-2018-8012 Source advisory: OSV:GHSA-CCQF-C5HQ-77MP...

CVE-2022-1352

Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that...

A scanning tool for open-sourced software packages? Yes, please!

The Open Source Security Foundation OpenSSF, a collective of industry leaders aimed at improving the security of open-source software OSS, recently announced the release of a prototype tool that scans for malicious packages in open source repositories. This tool, conveniently called Package...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-google-slothfs-0-0.10.20200727git59c1163.fc36

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

CVE-2022-1502

Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions...