CloudBees Jenkins Crowd 2 Integration Plugin Storing Credentials in Plain Text Format Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. It is mainly used to monitor continuous software version release/testing projects and some timed tasks.Crowd 2 Integration Plugin is used in which a Authentication Plugin. A...

CVE-2018-1000408

CVE-2018-1000408 describes a denial-of-service vulnerability in Jenkins where, on builds using the built-in Jenkins user database (HudsonPrivateSecurityRealm), an attacker without Overall/Read permission can access a specific URL, causing an ephemeral user record to be created in memory. Affected...

PT-2019-8719

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.145 and earlier Jenkins LTS versions 2.138.1 and earlier Description A denial of service issue exists that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins use...

TIBCO FTL realm server component cross-site request forgery vulnerability

TIBCO FTL is a data distribution solution from TIBCO Software. realm server tibrealmserver is one of the Realm server components. A cross-site request forgery vulnerability exists in the realm server component of TIBCO FTL. An attacker could exploit this vulnerability to gain realm configuration...

CVE-2018-12412 TIBCO FTL Realm Server Vulnerable to CSRF Attacks

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12412: Cross-Site Request Forgery (CSRF)

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12412

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

TIBCO Security Advisory:November 6, 2018 - TIBCOFTL

TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6,2018 Last revised: CVE-2018-12412 Source: TIBCO Software Inc. TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIBCO Software Inc. Systems Affected...

TIBCO Security Advisory:November 6, 2018 - TIBCOFTL

TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6,2018 Last revised: CVE-2018-12412 Source: TIBCO Software Inc. TIBCO FTL Realm Server Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIBCO Software Inc. Systems Affected...

GHSA-778X-2MQV-W6XW Moderate severity vulnerability that affects org.keycloak:keycloak-core

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm...

Ephemeral user record was created on some invalid authentication attempts

When attempting to authenticate using API token, an ephemeral user record was created to validate the token in case an external security realm was used, and the user record in Jenkins not previously saved, as legacy API tokens could exist without a persisted user record. This behavior could be...

CVE-2018-10683

DISPUTED An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a...

CVE-2018-11298

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing SETPASSPOINTLIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is...

CVE-2018-11298

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing SETPASSPOINTLIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is...

CVE-2018-11298: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing SETPASSPOINTLIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is...

CVE-2018-1999045

The connected documents confirm CVE-2018-1999045 affects Jenkins versions up to 2.137/2.121.2 (and LTS up to 2.121.3) due to improper authentication in SecurityRealm.java and TokenBasedRememberMeServices2.java, allowing an attacker with a valid cookie to stay logged in even when remember-me is di...

openSUSE Security Update : libheimdal (openSUSE-2018-876)

This update for libheimdal to version 7.5.0 fixes the following issues : The following security vulnerability was fixed : - CVE-2017-17439: Fixed a remote denial of service vulnerability through which remote unauthenticated attackers were able to crash the KDC by sending a crafted UDP packet...

Security update for libheimdal (important)

This update for libheimdal to version 7.5.0 fixes the following issues: The following security vulnerability was fixed: - CVE-2017-17439: Fixed a remote denial of service vulnerability through which remote unauthenticated attackers were able to crash the KDC by sending a crafted UDP packet...

Ephemeral user record was created on some invalid authentication attempts

When attempting to authenticate using API token, an ephemeral user record was created to validate the token in case an external security realm was used, and the user record in Jenkins not previously saved, as legacy API tokens could exist without a persisted user record. This behavior could be...