GHSA-9RVW-7MX7-H53X CSRF vulnerability in Jenkins Database Plugin

A cross-site request forgery CSRF vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials. Database Plugin 1.7 requires POST requests for the affected form validation method...

CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

CVE-2022-29163 Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a pat...

PT-2022-19422 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.6 Nextcloud Server versions prior to 23.0.3 Description: The issue allows a user to create a link that is not password protected, even if the administrator requires links to be password protected. There...

GHSA-HRWC-PQFM-G6QF Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

Subversion Plugin connects to a user-specified Subversion repository as part of form validation e.g. to retrieve a list of tags. This functionality improperly checked permissions, allowing any user with Item/Build permission but not Item/Configure to connect to any web server or Subversion server...

CSRF vulnerability and missing permission checks in blueocean

blueocean 1.25.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to send requests to an attacker-specified URL. Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery CSRF...

AlmaLinux 8 : postgresql:10 (ALSA-2022:1830)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1830 advisory. postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenable has extracted the preceding description block directly from the...

.NET 5.0 Update: May 10, 2022 (KB5014329)

None None...

.NET 6.0 Update: May 10, 2022 (KB5014330)

None None...

CVE-2022-28275 Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe Photoshop versions 22.5.6 and earlier and 23.2.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious fil...

Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload

Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload...

DEBIAN-CVE-2021-22573

The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation ...

GSD-2022-1001603 mm/kmemleak: reset tag when compare object pointer

mm/kmemleak: reset tag when compare object pointer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

missing a check

Lines of code Vulnerability details Impact in citadelMinter.setCitadelDistributionSplit there is a require check that check the sum of the propvalues must be 10000 bps and POLICYOPERATIONSROLE can set 2 of the variable to 0 and 1 to 10000 it is better to make a min value to the variables and chec...

PT-2022-17986 · Zoho · Zoho Manageengine Remote Access Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Remote Access Plus versions prior to 10.1.2137.15 Description: The issue allows guest users to view domain details, including the username and GUID of an administrator. Recommendations: For versions prior to 10.1.2137.15,...

GHSA-2XXX-FHC8-9QVQ Ecto missing `is_nil` requirement

Ecto will not raise on queries with non-explicit nil comparisons ie if they aren't checked with isnil...

Ecto missing `is_nil` requirement

Ecto will not raise on queries with non-explicit nil comparisons ie if they aren't checked with isnil...

CVE-2022-28352

WeeChat aka Wee Enhanced Environment for Chat 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects...

CVE-2021-23850

A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload...

CSRF vulnerability and missing permission checks in proxmox

proxmox 0.7.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to: connect to an attacker-specified host using attacker-specified username and password, performing a connection test, disable SSL/TLS validation for the...