Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228Apache Log4j Remote Code Execution） all log...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2021-3597 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

ch.inftec.ju:ju-testing-ee (>=4.1, <=4.2), org.jboss:jboss-remote-naming (>=1.0.0.final, <=1.0.5.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.0.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.1, =1.0.0.final, =1.0.5.final Source cves: CVE-2021-20250 Source...

ch.inftec.ju:ju-testing-ee (>=4.4-4, <=4.5.1-11), ch.inftec.ju:ju-util-ee (>=4.4-4, <=4.5.1-11) +6 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.5.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.4-4, =4.4-4, =0.2.4, =0.2.9, =0.3.0 Source cves: CVE-2021-20250 Source...

GHSA-CCWP-633J-G29V Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin

ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system. ReadyAPI Functional Testi...

GHSA-Q4QQ-8Q2R-G2F2 Passwords transmitted in plain text by Jenkins ReadyAPI Functional Testing Plugin

ReadyAPI Functional Testing Plugin stores project passwords in job config.xml files on the Jenkins controller as part of its configuration. While these passwords are stored encrypted on disk since ReadyAPI Functional Testing Plugin 1.4, they are transmitted in plain text as part of the global...

Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin

ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system. ReadyAPI Functional Testi...

ch.inftec.ju:ju-testing-ee (>=4.1, <=4.2), org.jboss:jboss-remote-naming (>=1.0.0.final, <=1.0.5.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.0.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.1, =1.0.0.final, =1.0.5.final Source cves: CVE-2020-14297 Source...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-8X6C-375H-PM4F Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

org.grails:grails-dependencies (2.0.3), org.grails:grails-plugin-testing (2.0.3) potentially affected by CVE-2019-12728 via org.grails:grails-core (2.0.3)

org.grails:grails-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.0.3 - org.grails:grails-plugin-testing 2.0.3 Source cves: CVE-2019-12728 Source...

org.grails:grails-dependencies (2.1.1), org.grails:grails-plugin-testing (2.1.1) potentially affected by CVE-2019-12728 via org.grails:grails-core (2.1.1)

org.grails:grails-core MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.1.1 - org.grails:grails-plugin-testing 2.1.1 Source cves: CVE-2019-12728 Source...

org.grails:grails-plugin-testing (2.0.2) potentially affected by CVE-2019-12728 via org.grails:grails-core (2.0.2)

org.grails:grails-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-plugin-testing 2.0.2 Source cves: CVE-2019-12728 Source advisory: OSV:GHSA-PMXF-4V8C-RWR7...

The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking

Following a recent Supreme Court ruling, the Justice Department will no longer prosecute "good faith" security researchers with cybercrimes: The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solel...

Microsoft XML Core Services Information Disclosure Vulnerability

Microsoft XML Core Services MSXML improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site...

Spring for GraphQL 1.0 Release

On behalf of the Spring for GraphQL team and every contributor, it is my pleasure to announce the 1.0 GA release. Its been 10 months since the project was announced and under 2 years since the first commit, unremarkably called "first commit". The project began with the modest goal to replace the...

Kali Linux 2022.2 - Penetration Testing and Ethical Hacking Linux Distribution

Time for another Kali Linux release! – Kali Linux 2022.2. This release has various impressive updates. The summary of the changelog since the 2022.1 release from February 2022 is: GNOME 42 - Major release update of the popular desktop environment KDE Plasma 5.24 - Version bump with a more...

GHSA-MV8G-FHH6-6267 Django user with hardcoded password created when running tests on Oracle

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...