PT-2019-14711 · Jenkins · Jenkins Rundeck Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Rundeck Plugin versions 3.6.5 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file and in job config.xml files on the Jenkins master. This can be accessed by users with Extend...

PT-2019-14722 · Jenkins · Jenkins Team Concert Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Concert Plugin versions 1.3.0 and earlier Description: A missing permission check in form-related methods allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Recommendations: For...

CVE-2019-16567: Missing Authorization

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

SSL/TLS certificate validation globally and unconditionally disabled by websphere-deployer

websphere-deployer 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM, or specify a new Java keystore from a file stored on the Jenkins controller filesystem. As of publication of this advisory, ther...

Users with Overall/Read access can enumerate credential IDs in teamconcert

teamconcert 1.3.0 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be...

OpenSC has an unspecified vulnerability

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC versions 0.19.0 and earlier and versions 0.20.x through 0.20.0-rc3, which stems from the libopensc/card-setcos.c file not being read correctly. An attacker can exploit this vulnerability to perform...

CVE-2019-19449

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fsbuildsegmentmanager in fs/f2fs/segment.c, related to initminmaxmtime in fs/f2fs/segment.c because the second argument to getsegentry is not validated...

CVE-2019-19449

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fsbuildsegmentmanager in fs/f2fs/segment.c, related to initminmaxmtime in fs/f2fs/segment.c because the second argument to getsegentry is not validated...

CVE-2019-19449

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fsbuildsegmentmanager in fs/f2fs/segment.c, related to initminmaxmtime in fs/f2fs/segment.c because the second argument to getsegentry is not validated...

CVE-2019-4465

IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774...

DEBIAN-CVE-2012-0842

surf: cookie jar has read access from other local user...

Code injection

surf: cookie jar has read access from other local user...

CVE-2012-0842

surf: cookie jar has read access from other local user...

CVE-2012-0842

surf: cookie jar has read access from other local user...

CVE-2012-0842

CVE-2012-0842 affects surf: the cookie jar can be read by a local user, enabling potential private cookie disclosure. The available documents describe the issue and its local access impact but do not provide exploitation details or remediation guidance.

CVE-2012-0842

surf: cookie jar has read access from other local user...

PT-2019-6728

Name of the Vulnerable Software and Affected Versions surf affected versions not specified Description The issue concerns a cookie jar in the surf application that has read access from other local users. Recommendations At the moment, there is no information about a newer version that contains a...

CVE-2012-4438

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code...

CVE-2019-13535: Protection Mechanism Failure

In Medtronic Valleylab FT10 Energy Platform VLFT10GEN version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform VLLS10GEN—not available in the United States version 1.20.2 and lower, the RFID security mechanism does not apply read protection, allowing for full read...

PT-2019-13399

Name of the Vulnerable Software and Affected Versions Medtronic Valleylab FT10 Energy Platform versions 2.1.0 and lower Medtronic Valleylab FT10 Energy Platform version 2.0.3 and lower Valleylab LS10 Energy Platform versions 1.20.2 and lower Description The issue concerns the RFID security...