CVE-2015-5325

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665...

CVE-2015-5325

CVE-2015-5325 affects Jenkins before 1.638 and OpenJenkins LTS before 1.625.2, where a JNLP slave can bypass intended slave-to-master access restrictions. This vulnerability stems from an incomplete fix for CVE-2014-3665. Remediation: upgrade to Jenkins 1.638 or newer, or to LTS 1.625.2 or newer,...

CVE-2015-5326

Cross-site scripting XSS vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message...

PT-2015-3731 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.587 Jenkins LTS versions prior to 1.580.1 Description: The issue is related to improper trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by...

[SECURITY] Fedora 23 Update: jenkins-remoting-2.53-1.fc23

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

ISC BIND 9 - TKEY (PoC)

/ PoC for BIND9 TKEY assert Dos CVE-2015-5477 Usage: tkill What it does: - First sends a "version" query to see if the server is up. - Regardless of the version response, it then sends the DoS packet. - Then it waits 5 seconds for a response. If the server crashes, there will be no response. Note...

Cisco Unified Computing System Manager Local Arbitrary Command Injection Vulnerability

Cisco Unified Computing System Manager provides unified, embedded management of all hardware and software components within a unified computing system. A local arbitrary command injection vulnerability exists in the Manager component of Cisco Unified Computing System UCS 2.23b, where an attacker...

icmpsh - Simple Reverse ICMP Shell

Sometimes, network administrators make the penetration tester's life harder. Some of them do use firewalls for what they are meant to, surprisingly! Allowing traffic only onto known machines, ports and services ingress filtering and setting strong egress access control lists is one of these cases...

Modbus/TCP Report Slave ID

Binary data scadamodbusreptslvidcheck.nbin...

[SECURITY] Fedora 21 Update: jenkins-remoting-2.48-1.fc21

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

FreeBSD : kwebkitpart, kde-runtime -- insufficient input validation (890b6b22-70fa-11e4-91ae-5453ed2e2b49)

Albert Aastals Cid reports : kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to some JavaScript being executed on the context of the referenced hostname. Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO...

jenkins -- slave-originated arbitrary code execution on master servers

Kohsuke Kawaguchi from Jenkins team reports: Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the master...

jenkins: remote code execution from slaves (SECURITY-144)

Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave...

CVE-2014-0777

The Modbus slave/outstation driver in the OPC Drivers 1.0.20 and earlier in IOServer OPC Server allows remote attackers to cause a denial of service out-of-bounds read and daemon crash via a crafted packet...

CVE-2014-0777

The CVE-2014-0777 issue affects IOServer’s OPC Server (Windows) in the Modbus slave/outstation driver present in OPC Drivers 1.0.20 and earlier. The root cause is an out-of-bounds read in the Modbus driver, which attackers can trigger with a crafted packet to cause denial of service (daemon crash...

CVE-2013-2822

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

Design/Logic Flaw

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

Design/Logic Flaw

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service driver crash and process restart via a crafted DNP3 TCP packet...

CVE-2013-2821

NovaTech Orion Substation Automation Platform (OrionLX DNP Master 1.27.38 / DNP Slave 1.23.10 and Orion5/Orion5r 1.27.38 / 1.23.10 and earlier) contains an improper input validation vulnerability in the DNP3 implementation that can cause the Orion Process to restart (driver crash) when processing...

CVE-2013-2788

The DNP3 Slave service in SUBNET Solutions SubSTATION Server 2.7.0033 and 2.8.0106 allows remote attackers to cause a denial of service unhandled exception and process crash via unspecified vectors...