Input validation

Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content...

CVE-2019-12153

RealObjects PDFreactor (before 10.1.10722) contains a flaw in its HTML parser that fails validation, enabling server-side request forgery (SSRF) by supplying malicious HTML content. The issue can allow an attacker to access network or file resources from the server. Public references indicate the...

CVE-2019-11334

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...

[SECURITY] [DLA 1816-1] otrs2 security update

Package : otrs2 Version : 3.3.18-1+deb8u10 CVE ID : CVE-2019-12248 CVE-2019-12497 Two security vulnerabilities were discovered in the Open Ticket Request System that could lead to information disclosure or privilege escalation. New configuration options were added to resolve those problems...

GHSA-8W57-JFPM-945M Denial of Service in http-proxy-agent

Versions of http-proxy-agent before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to Buffer. An attacker may leverage these unsanitized options to consume system resources. Recommendation Update to version 2.1.0 or later...

CVE-2019-10339

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfigurationdoValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials...

CVE-2019-10338

A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfigurationdoValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials...

CVE-2019-10339

The CVE-2019-10339 issue affects Jenkins JX Resources Plugin (versions ≤1.0.36). A missing permission check in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read to connect to an attacker-specified Kubernetes server, potentially leaking credentials and exposing environment...

CVE-2019-10338

The CVE-2019-10338 issue affects Jenkins JX Resources Plugin (versions 1.0.36 and earlier). The root cause is a lack of permission checks in a form-validation method (GlobalPluginConfiguration#doValidateClient), enabling a user with Jenkins access to cause Jenkins to connect to an attacker-specif...

Description of the security update for SharePoint Server 2019: June 11, 2019

None None...

PT-2019-11737 · Jenkins · Jenkins Jx Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JX Resources Plugin versions 1.0.36 and earlier Description: A cross-site request forgery issue allows attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials. The vulnerability is...

Optergy Proton/Enterprise Authentication Error Vulnerability

Optergy Proton/Enterprise is an enterprise building management system from Optergy USA. An authentication error vulnerability exists in Optergy Proton/Enterprise versions 2.3.0a and earlier. An attacker could exploit the vulnerability to gain direct party access to specific resources...

PT-2019-11738 · Jenkins · Jenkins Jx Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JX Resources Plugin versions 1.0.36 and earlier Description: A missing permission check in the GlobalPluginConfigurationdoValidateClient method allowed users with Overall/Read access to connect to an attacker-specified Kubernetes...

jenkins-plugin-lockable-resources: XSS vulnerability in Lockable Resources Plugin (SECURITY-1361)

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin...

OTRS 5.x < 5.0.36, 6.x < 6.0.19, 7.x < 7.0.8 Multiple Vulnerabilities

OTRS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrs"; if description...

CVE-2019-3790

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was...

Security and Human Behavior (SHB) 2019

Today is the second day of the twelfth Workshop on Security and Human Behavior, which I am hosting at Harvard University. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro Acquisti, Ross Anderson, and...

Denial of Service in js-yaml

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. Recommendation Upgrade to version 3.13.0...

GHSA-2PR6-76VF-7546 Denial of Service in js-yaml

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. Recommendation Upgrade to version 3.13.0...

Remote Code Execution (RCE)

rkt is vulnerable to remote code execution. Processes run with rkt enter do not have seccomp filtering during stage 2, allowing the attacker to run scripts that access host resources...