serena.bookingonline.fi Cross Site Scripting vulnerability OBB-3392794

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-RWRX-HRF2-V577 Jenkins Serena SRA Deploy Plugin stores credentials in plain text

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file com.urbancode.ds.jenkins.plugins.serenarapublisher.UrbanDeployPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Jenkins Serena SRA Deploy Plugin stores credentials in plain text

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file com.urbancode.ds.jenkins.plugins.serenarapublisher.UrbanDeployPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

CloudBees Jenkins Serena SRA Deploy Plugin Trust Management Issue Vulnerability

CloudBees Jenkins Hudson Labs is a suite of Java-based continuous integration tools from the US-based CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Serena SRA Deploy Plugin is used in which a plug-in for the deployme...

CVE-2019-10296

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10296

CVE-2019-10296 affects the Jenkins Serena SRA Deploy Plugin. The vulnerability arises from credentials being stored unencrypted in the plugin’s global configuration on the Jenkins master, specifically in the UrbanDeployPublisher.xml file, which can be read by anyone with access to the Jenkins con...

CVE-2019-10296

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-10296

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

PT-2019-11698 · Jenkins · Jenkins Serena Sra Deploy Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Serena SRA Deploy Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the...

Serena TeamTrack 6.1.1 - Remote Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10770/info It has been reported that Serena TeamTrack is affected by remote authentication bypass vulnerability. This issue is due to a design error that allows unauthenticated users to access sensitive scripts. Successfu...

Serena Dimensions CM跨站脚本漏洞

Bugtraq ID:65976 CVE ID:CVE-2014-0335 Serena Dimensions CM是一款项目计划管理工具。 Serena Dimensions CM存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Serena Dimensions CM 12.2 Build 7.199.0 web client 目前没有详细解决方案提供： http://www.serena.com/index.php/en/products/featured-products/dimensions-cm/...

Serena Dimensions CM跨站请求伪造漏洞

Bugtraq ID:65981 CVE ID:CVE-2014-0336 Serena Dimensions CM是一款项目计划管理工具。 Serena Dimensions CM存在一个跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 Serena Dimensions CM 12.2 Build 7.199.0 web client 目前没有详细解决方案提供： http://www.serena.com/index.php/en/products/featured-products/dimensions-cm/ html !--...

CVE-2014-0336

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

CVE-2014-0335

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

CVE-2014-0336

The CVE-2014-0336 issue affects Serena Dimensions CM 12.2 Build 7.199.0 web client (and possibly earlier) and is caused by a cross-site request forgery (CSRF) vulnerability in the web client. An attacker can craft a malicious URI to perform actions in an administrator’s session via the user_new_m...

CVE-2014-0335

Serena Dimensions CM 12.2 Build 7.199.0 web client contains multiple cross-site scripting vulnerabilities (CWE-79). Exploitable via unauthenticated vectors in parameters such as DB_CONN, DB_NAME, DM_HOST, MAN_DB_NAME, framecmd, identifier, merant.adm.adapters.AdmDialogPropertyMgr, nav_frame, nav_...

CVE-2014-0336

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...