SUSE CVE-2009-1577

Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long 1 function name or 2 symbol in a source-code file...

CVE-2022-2180

The CVE-2022-2180 issue affects the GREYD.SUITE WordPress theme and related listings, where unauthenticated users can upload arbitrary files (including PHP) via the theme’s custom font upload workflow due to missing authorization/CSRF checks. This can lead to remote code execution (RCE). Affected...

GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE

The plugin does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution RCE. Version 1.2.5 added CSRF checks PoC...

Privilege Escalation

needrestart is vulnerable to privilege escalation. The vulnerability exists when the library tries to detect if interpreters are using old source files...

GHSA-2XVX-RW9P-XGFC Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin

Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection. In Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier, any Groovy source files bundled with Jenkins core and plugins could ...

CVE-2022-30688

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files...

CVE-2022-30688

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files...

CVE-2022-30945

Jenkins Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines...

PT-2022-20399 · Jenkins · Jenkins Pipeline: Groovy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier Description: The issue allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. This could potentially be used to...

GHSA-QRCX-P4RR-G48H Apache Tomcat allows remote attackers to read JSP source files

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information...

Apache Tomcat allows remote attackers to read JSP source files

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information...

USN-5375-1: GNU cflow vulnerability

It was discovered that GNU cflow was incorrectly handling memory cleanup operations at the end of a compilation module. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code...

bikeshed path traversal vulnerability

bikeshed is a preprocessor for specification documents, converting the source document which contains only the actual specification content, plus some shorthand for linking terms and other content into a final specification document with appropriate samples, bibliographies, indexes, and so on. A...

CVE-2021-23423

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output...

[SECURITY] Fedora 33 Update: cflow-1.6-8.fc33

GNU cflow analyzes a collection of C source files and prints a graph, charting control flow within the program. GNU cflow is able to produce both direct and inverted flowgraphs for C sources. Optionally a cross-reference listing can be generated. Two output formats are implemented: POSIX and GNU...

[SECURITY] Fedora 34 Update: cflow-1.6-8.fc34

GNU cflow analyzes a collection of C source files and prints a graph, charting control flow within the program. GNU cflow is able to produce both direct and inverted flowgraphs for C sources. Optionally a cross-reference listing can be generated. Two output formats are implemented: POSIX and GNU...

Security Bulletin: Apache Ant Vulnerabilities Affect IBM Control Center (CVE-2020-1945, CVE-2020-11979)

Summary Apache Ant could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sendin...

Security Bulletin: Vulnerability in Apache Ant affect IBM Operations Analytics - Log Analysis Analysis (CVE-2020-1945)

Summary A vulnerability in Apache Ant which could potentially leak sensitive information was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of...

Security Bulletin: Resilient is affected by a potential leak of internal information due to exposed generated source files (CVE-2017-1658)

Summary Security Bulletin: Resilient is affected by a potential leak of internal information due to exposed generated source files CVE-2017-1658 Vulnerability Details Summary Resilient has addressed the following vulnerability by removing external access to generated source files. Vulnerability...

Security Bulletin: Vulnerability in Apache Ant affects IBM Spectrum Symphony

Summary These interim fixes provide instructions on upgrading Apache Ant to 1.10.9 in IBM Spectrum Symphony 7.2.0.2, IBM Spectrum Symphony 7.2.1, IBM Spectrum Symphony 7.3, and IBM Spectrum Symphony 7.3.1 in order to address security vulnerability CVE-2020-11979 in Apache Ant. Vulnerability Detai...