Vulnerability of the components AbstractDslScriptLoader.groovy, JobDslWhitelist.groovy, and SandboxDslScriptLoader.groovy, a Jenkins Job DSL plugin, allowing a malicious actor to execute arbitrary code

The vulnerabilities of components AbstractDslScriptLoader.groovy core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, JobDslWhitelist.groovy job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, and...

The vulnerabilities of the components GroovySandbox.java and SecureGroovyScript.java of the Jenkins Script Security plugin allow a perpetrator to execute arbitrary code.

The vulnerabilities of the GroovySandbox.java component src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java and SecureGroovyScript.java component src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java of the Jenkins Script Securi...

The vulnerability of the RejectASTTransformsCustomizer.java component of the Jenkins Script Security plugin allows a perpetrator to execute arbitrary code.

The vulnerability of the RejectASTTransformsCustomizer.java component of the Jenkins Script Security plugin is related to errors in processing AST annotations. Exploiting this vulnerability can allow a malicious actor to exit from an isolated programming environment and execute arbitrary code...

The vulnerability of the pom.xml components and CpsGroovyShell.java plugin of the Jenkins Pipeline allows a hacker to execute arbitrary code.

The vulnerability of the pom.xml components and CpsGroovyShell.java src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java of the Jenkins Pipeline plugin is related to errors in processing input data during syntax analysis of the code. Exploiting this vulnerability can allow a...

Buffer overflow

An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syntax list size...

CVE-2019-12798

An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syntax list size...

Cross site scripting

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

CVE-2019-6740

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update SMR-JAN-2019 - SVE-2018-13467. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...

CVE-2019-12172

Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...

Code injection

Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...

CVE-2019-12172

CVE-2019-12172 concerns Typora 0.9.9.21.1 (1913) where an arbitrary code execution is possible via a modified file: URL syntax in the HREF attribute of an AREA element, demonstrated with file:\ on macOS/Linux or file://C| on Windows. Red Hat entries corroborate Typora impact for the same version ...

[SECURITY] Fedora 29 Update: perl-YAML-1.28-1.fc29

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification http://www.yaml.org/spec/. YAML is a generic data serializa tion language that is optimized for human readability. It can be used to express the data structures of most modern programming languages, includi...

Denial Of Service (DoS)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS clie...

[SECURITY] Fedora 30 Update: python-jinja2-2.10.1-1.fc30

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the syntactic analyzer of the Microsoft XML Core Services for Windows operating systems is related to errors in restricting XML references to external objects. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

W12Scan - A Simple Asset Discovery Engine For Cybersecurity

Chinese W12scan is a network asset discovery engine that can automatically aggregate related assets for analysis and use. Here is a web source program, but the scanning end is at w12scan-client Thinking Based on python3 + django + elasticsearch + redis and use the web restful api to add scan...

openSUSE Security Update : cgit (openSUSE-2019-595)

This update for cgit fixes the following issues : The following security vulnerability was addressed : - CVE-2018-14912: Fixed a directory traversal vulnerability, when enable-http-clone=1 is not turned off boo1103799 The following other changes were made : - Update to upstream release 1.2.1 -...

The vulnerability of the fly-admin-ntp package for managing NTP time services on the Astra Linux operating system allows a perpetrator to cause a service failure.

The vulnerability of the fly-admin-ntp package for managing NTP time services on the Astra Linux operating system is related to incorrect syntax analysis and processing of the configuration file. Exploiting this vulnerability can allow an attacker to cause a service failure...

DEBIAN-CVE-2019-9209

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values...

OPENSUSE-SU-2019:0244-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - Update to 2.8 - Added target parameter to urlize function. - Added support for followsymlinks to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache...