jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

It was discovered that the internal Jenkins user database did not restrict access to reserved names, allowing users to escalate privileges...

PT-2018-3523 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.4 Description: The issue is related to a buffer overflow in the fs/f2fs/inline.c component of the Linux kernel, which can lead to out-of-bounds memory access. This can cause a denial of service. The problem...

CVE-2015-8132

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7263. Reason: This candidate is a reservation duplicate of CVE-2015-7263. Notes: All CVE users should reference CVE-2015-7263 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2015-8133

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7264. Reason: This candidate is a reservation duplicate of CVE-2015-7264. Notes: All CVE users should reference CVE-2015-7264 instead of this candidate. All references and descriptions in this candidate have been removed to...

Comodo, CAs Issue Forbidden Certificates

Certificate authority Comodo admits it incorrectly issued eight certificates that include forbidden internal server names or reserved IP addresses. In 2012, the Certificate Authority/Browser Forum banned the use of such designations for certs issued after Nov. 1, 2015. The decision was meant to c...

CloudBees Jenkins CI and LTS Create Reserved Names Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI. A security vulnerability exists in the HudsonPrivateSecurityRealm class in CloudBees Jenkins CI...

CVE-2015-1810

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name...

CVE-2015-1810

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name...

CVE-2015-1810

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name...

jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

It was discovered that the internal Jenkins user database did not restrict access to reserved names, allowing users to escalate privileges...

Cisco Nexus 9000 Series Switches Reserved VLAN Number Vulnerability (Cisco-SA-20150916-CVE-2015-6295)

A vulnerability in the handling of incoming Layer 2 packets tagged with a Cisco Nexus 9000 Series Switch N9K reserved VLAN number could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition due to increased CPU utilization and possible control plane...

Code injection

Cisco NX-OS 6.12I34 and 7.03I11 on Nexus 9000 N9K devices allows remote attackers to cause a denial of service CPU consumption or control-plane instability or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560...

CVE-2015-6295

CVE-2015-6295 affects Cisco NX-OS running on Nexus 9000 series: 6.1(2)I3(4) and 7.0(3)I1(1). The vulnerability stems from handling of Layer 2 packets tagged with a reserved VLAN number, due to a lack of validation, which could allow an unauthenticated adjacent attacker to cause a partial DoS via ...

CVE-2015-6295

Cisco NX-OS 6.12I34 and 7.03I11 on Nexus 9000 N9K devices allows remote attackers to cause a denial of service CPU consumption or control-plane instability or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number, aka Bug ID CSCuw13560...

Cisco Nexus 9000 Series Switches Reserved VLAN Number Vulnerability

A vulnerability in the handling of incoming Layer 2 packets tagged with a Cisco Nexus 9000 Series Switch N9K reserved VLAN number could allow an unauthenticated, adjacent attacker to cause a partial denial of service DoS condition due to increased CPU utilization and possible control plane...

FreeBSD : jenkins -- multiple vulnerabilities (7480b6ac-adf1-443e-a33c-3a3c0becba1e)

Kohsuke Kawaguchi from Jenkins team reports : DescriptionSECURITY-125 Combination filter Groovy script unsecured This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. SECURITY-162 directory traversal...

OracleVM 3.1 : xen (OVMSA-2012-0039)

The remote OracleVM system is missing necessary patches to address critical security updates : - console: bounds check whenever changing the cursor due to an escape code The device model used by fully virtualised HVM domains, qemu, does not properly handle escape VT100 sequences when emulating...

IglooFTP PRO 3.8 - Multiple Buffer Overflow Vulnerabilities (2)

No description provided by source. source: http://www.securityfocus.com/bid/8117/info IglooFTP PRO for Windows platforms has been reported prone to multiple buffer overrun vulnerabilities. The issue likely presents itself due do a lack of sufficient bounds checking performed on data that is copie...

Standard & Poors ComStock 4.2.4 Machine Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/1080/info Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1 distribution. In...

CVE-2013-1870

CVE-2013-1870 is a reserved duplicate of CVE-2013-1869. Connected documents describe CVE-2013-1869 as a CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and RH Satellite 5.6, enabling HTTP header injection, response splitting, and possibly XSS via the return_url parameter. Remediat...