Jenkins SCM HttpClient Plugin 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site request...

CVE-2022-41249: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2022-25764 · Jenkins · Jenkins Scm Httpclient Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SCM HttpClient Plugin versions 1.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs, capturing credentia...

CVE-2022-41250: Missing Authorization

A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CSRF vulnerability and missing permission check in scm-httpclient allow capturing credentials

scm-httpclient 1.5 and earlier does not perform permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing...

Jenkins SCM HttpClient Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2022-30952

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

CVE-2022-30948

A flaw was found in the Jenkins plugin. Affected versions of the Jenkins Mercurial Plugin allow attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system. This is accomplished by using local paths as SCM URLs, obtaining limited...

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

Missing permission checks in compuware-scm-downloader

compuware-scm-downloader 2.0.12 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be...

HPE NonStop DSM/SCM Information Disclosure Vulnerability

HPE NonStop DSM/SCM is a tool from HPE USA for managing and configuring software installations on distributed target systems. An information disclosure vulnerability exists in HPE NonStop DSM/SCM version T6031H03^ADP, which can be exploited by an attacker to obtain sensitive information...

CVE-2022-28621

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

Information disclosure

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

CVE-2022-28621

CVE-2022-28621 describes a remote information-disclosure vulnerability in HPE NonStop DSM/SCM, affecting version T6031H03^ADP. The issue allows an attacker to obtain sensitive information and is reflected in public records with a partial confidentiality impact (NVD CVSS2/3.1: 5.0/7.5). HPE has pr...

CVE-2022-28621

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...

PT-2022-19109

Name of the Vulnerable Software and Affected Versions HPE NonStop DSM/SCM version T6031H03^ADP Description A remote disclosure of sensitive information issue was discovered. HPE has provided a software update to resolve this issue in HPE NonStop DSM/SCM. Recommendations For HPE NonStop DSM/SCM...

PT-2022-30966

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.18 through v5.18.2 Description A potential security issue exists due to leaking nvdimm events map elements in the powerpc/papr scm module. The actual impact and attack plausibility have not yet been proven...

PT-2022-30866

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.18.3 through 5.18.4 Description The issue is related to the powerpc/papr scm module in the Linux Kernel. It concerns a problem where stats are requested with a '0' sized stats buffer. The actual impact and attack...

CVE-2022-28621: Undefined Security Weakness

A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM...