4085 matches found
CVE-2019-19687
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforcescope is false. Users with a role on a project are able to view any other users' credentials,...
Unauthorized access vulnerability in Weave Scope (CNVD-2020-01342)
Weave Scope is a Docker and Kubernetes visualization and monitoring tool that provides a complete view of cluster infrastructure and applications from top to bottom, making it easy to monitor and diagnose problems with distributed containerized applications in real-time. An unauthorized access...
CVE-2019-16541
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct folder scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope...
CVE-2019-16541
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct folder scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope...
CVE-2019-16541
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct folder scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope...
CVE-2019-16541
Summary: CVE-2019-16541 affects Jenkins JIRA Plugin (versions ≤ 3.0.10). The vulnerability arises from the plugin not declaring the correct folder-scoped context for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Impact: potential credential expo...
CVE-2019-16541
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct folder scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope...
PT-2019-4454 · Jenkins · Jenkins Jira Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Plugin versions 3.0.10 and earlier Description: The issue is related to the incorrect declaration of the scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. This can lead to...
Asset Discover - Burp Suite Extension To Discover Assets From HTTP Response
Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blog Asset Discovery using Burp Suite for more details. The extension is now part of the BApp store and can be installed directly from the Burp Suite...
Intel Software Guard Extensions (SGX) Vulnerabilities - Lenovo Support US
No description provided...
Improper access control
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper...
CVE-2019-16919
Harbor API has a Broken Access Control vulnerability. The vulnerability allows project administrators to use the Harbor API to create a robot account with unauthorized push and/or pull access permissions to a project they don't have access or control for. The Harbor API did not enforce the proper...
CVE-2019-10445
A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID...
Missing permission checks in google-kubernetes-engine allowed validating and obtaining data
Missing permission checks in google-kubernetes-engine allowed users with Overall/Read permission to obtain limited information about the scope and access of a credential with an attacker-specified credential ID obtained through another method. google-kubernetes-engine now requires Job/Configure...
Cloud Foundry UAA Elevation of Authority Vulnerability
UAA is a multi-tenant identity management service used in Cloud Foundry and can also be used as a standalone OAuth2 server. An elevation of privilege vulnerability exists in Cloud Foundry UAA versions prior to 74.1.0. The vulnerability stems from the fact that UAA can request a scope for a client...
CVE-2019-11279
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls...
Cross site request forgery (csrf)
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls...
CVE-2019-11279 Privilege Escalation via Scope Manipulation in UAA
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls...
GnuCOBOL Resource Management Error Vulnerability
GnuCOBOL is a COBOL language compiler. A resource management error vulnerability exists in the 'endscopeofprogramname' function of the cobc/parser.y file in GnuCOBOL version 2.2, which arises from a networked system or product's improper management of system resources e.g., memory, disk space,...