PT-2025-45731

Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this endpoint does not require POST...

CVE-2025-64141: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials...

Jenkins Nexus Task Runner Plugin security vulnerabilities

Jenkins Nexus Task Runner Plugin is an open source plugin for Jenkins. A security vulnerability exists in Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier, which stems from vulnerability to a cross-site request forgery attack that could result in a connection to an attacker-specified UR...

PT-2025-44290

Name of the Vulnerable Software and Affected Versions Jenkins Nexus Task Runner Plugin versions 0.9.2 and earlier Description A cross-site request forgery CSRF issue exists in the Jenkins Nexus Task Runner Plugin. This allows attackers to connect to a URL specified by the attacker, using...

CSRF vulnerability and missing permission checks in nexus-task-runner

nexus-task-runner 0.9.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this endpoint does not require POST requests,...

Malicious code in browser-sync-task-runner (npm)

The package browser-sync-task-runner was found to contain malicious code...

MAL-2025-16199 Malicious code in browser-sync-task-runner (npm)

The package browser-sync-task-runner was found to contain malicious code...

[SECURITY] Fedora 41 Update: golang-github-task-3.40.1-1.fc41

A task runner / simpler Make alternative written in Go...

From Spring Cloud Data Flow 2.11.x to 3.0

Dear Spring Community, With the recent announcement of Spring Framework 7.0 and Spring Boot 4.0, the Spring Cloud Data Flow team is pleased to announce the next major release, SCDF 3.0, to align with both Spring Framework 7.0 and Spring Boot 4.0. This will bring the following SCDF ecosystem of...

Fedora: Security Advisory for golang-github-task (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-task-3.14.0-3.fc36

A task runner / simpler Make alternative written in Go...

[SECURITY] Fedora 35 Update: golang-github-task-3.14.0-2.fc35

A task runner / simpler Make alternative written in Go...

Cilantro path traversal vulnerability

cilantro is an open source task runner from Deutsches Archäologisches Institut in Germany. Designed to manage long running distributed jobs that operate on file system objects . cilantro version 0.0.4 and earlier versions of a security vulnerability , the vulnerability stems from Flask's sendfile...

Malicious Package

Overview cs-task-runner is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious code in cs-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39698ac329277055768167de3fa99bf56777d8a97481cea290407f8226eeedb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

jenkins.plugins.htmlaudio:html-audio-notifier (0.1), org.jenkins-ci.main:jenkins-test-harness (1.431) +14 more potentially affected by CVE-2017-1000391 via org.jenkins-ci.main:jenkins-core (1.431)

org.jenkins-ci.main:jenkins-core MAVEN version 1.431 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - jenkins.plugins.htmlaudio:html-audio-notifier 0.1 - org.jenkins-ci.main:jenkins-test-harness...

[ASA-202107-34] code: arbitrary code execution

Arch Linux Security Advisory ASA-202107-34 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ======= The package co...

USN-4595-1: Grunt vulnerability

It was discovered that Grunt did not properly load yaml files. An attacker could possibly use this to execute arbitrary code. CVE-2020-7729...

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...