[SECURITY] Fedora 22 Update: jenkins-remoting-2.53-1.fc22

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2015-07821)

CloudBees Jenkins is the open source continuous integration server. A cross-site scripting vulnerability exists in CloudBees Jenkins 1.638, LTS versions prior to 1.625.2, in the slave overview page, where a remote user with certain privileges can inject web script or HTML via a slave offline stat...

CVE-2015-5326

Cross-site scripting XSS vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message...

CVE-2015-5320

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

CVE-2015-5326

Cross-site scripting XSS vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message...

CVE-2015-5320

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

Cross site scripting

Cross-site scripting XSS vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message...

Information disclosure

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

CVE-2015-5325

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665...

CVE-2015-5325

CVE-2015-5325 affects Jenkins before 1.638 and OpenJenkins LTS before 1.625.2, where a JNLP slave can bypass intended slave-to-master access restrictions. This vulnerability stems from an incomplete fix for CVE-2014-3665. Remediation: upgrade to Jenkins 1.638 or newer, or to LTS 1.625.2 or newer,...

CVE-2015-5326

Cross-site scripting XSS vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message...

PT-2015-3731 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.587 Jenkins LTS versions prior to 1.580.1 Description: The issue is related to improper trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by...

[SECURITY] Fedora 23 Update: jenkins-remoting-2.53-1.fc23

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

ISC BIND 9 - TKEY (PoC)

/ PoC for BIND9 TKEY assert Dos CVE-2015-5477 Usage: tkill What it does: - First sends a "version" query to see if the server is up. - Regardless of the version response, it then sends the DoS packet. - Then it waits 5 seconds for a response. If the server crashes, there will be no response. Note...

Cisco Unified Computing System Manager Local Arbitrary Command Injection Vulnerability

Cisco Unified Computing System Manager provides unified, embedded management of all hardware and software components within a unified computing system. A local arbitrary command injection vulnerability exists in the Manager component of Cisco Unified Computing System UCS 2.23b, where an attacker...

icmpsh - Simple Reverse ICMP Shell

Sometimes, network administrators make the penetration tester's life harder. Some of them do use firewalls for what they are meant to, surprisingly! Allowing traffic only onto known machines, ports and services ingress filtering and setting strong egress access control lists is one of these cases...

Modbus/TCP Report Slave ID

Binary data scadamodbusreptslvidcheck.nbin...

[SECURITY] Fedora 21 Update: jenkins-remoting-2.48-1.fc21

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

FreeBSD : kwebkitpart, kde-runtime -- insufficient input validation (890b6b22-70fa-11e4-91ae-5453ed2e2b49)

Albert Aastals Cid reports : kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to some JavaScript being executed on the context of the referenced hostname. Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO...

jenkins -- slave-originated arbitrary code execution on master servers

Kohsuke Kawaguchi from Jenkins team reports: Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the master...