postgresql-jdbc: Arbitrary File Write Vulnerability

A flaw was found in Postgres JDBC. This flaw allows an attacker to use a method to write arbitrary files through the connection properties settings. For example, an attacker can create an executable file under the server the application is running and make it a new part of the application or serv...

jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

[SECURITY] Fedora 36 Update: golang-github-hashicorp-memdb-1.3.0-5.fc36

The Memdb package implements a simple in-memory database built on immutable radix trees. The database provides Atomicity, Consistency and Isolation from ACID. Being that it is in-memory, it does not provide durability. The database is instantiated with a schema that specifies the tables and indic...

CVE-2022-23720

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID...

CVE-2022-23720

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID...

CVE-2022-23720 PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file

PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID...

gnome-control-center bug fix and enhancement update

An update is available for gnome-control-center. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gnome-control-center package contains configuration utilitie...

nodejs: Prototype pollution via console.table properties

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

Jenkins Plugin EasyQA 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins EasyQA Plugin 1.0 and prior...

PT-2022-22072 · Jenkins · Jenkins Easyqa Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins EasyQA Plugin versions 1.0 and earlier Description: The issue concerns the storage of user passwords in an unencrypted manner within the global configuration file on the Jenkins controller. Specifically, the passwords are stored in th...

Malicious code in additional-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76a44ce34d1ad24320b0c2a981a6691a1d0c55ecd04f7d7fd24dd29ae86f8df4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-851 Malicious code in additional-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76a44ce34d1ad24320b0c2a981a6691a1d0c55ecd04f7d7fd24dd29ae86f8df4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHEL 7 : rh-nodejs12-nodejs (RHSA-2022:4914)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4914 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

protobuf.js 安全漏洞

protobuf.js is a pure JavaScript implementation of protobufjs with a protocol buffer implementation for node.js and browser TypeScript support. It is easy to use, extremely fast, and works out-of-the-box with .proto files! A security vulnerability exists in protobuf.js versions prior to 6.11.3. A...

Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...

GHSA-7QF3-C2Q8-69M3 Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...

Improper handling of REST API XML deserialization errors in Jenkins

Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...

GHSA-PJW3-C74J-M9FJ Password in config file in KIE server

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services...

Preparing for Spring Boot 3.0

Spring Boot 2.0 was the first release in the 2.x line and was published on Feburary 28th 2018. Weve just released Spring Boot 2.7 which means that, so far, weve been maintaining the 2.x line for just over 4 years. In total weve published 95 distinct releases over that timeframe! The entire Spring...

andalucianproperties.info Cross Site Scripting vulnerability OBB-2623324

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...