3923 matches found
dhowden tag panic due to out-of-bounds read
Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via readAPICFrame due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack...
GHSA-WPHQ-J78P-FHGP Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with acce...
Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with acce...
com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +15 more potentially affected by CVE-2020-2223 via org.jenkins-ci.main:jenkins-core (1.651.2)
org.jenkins-ci.main:jenkins-core MAVEN version 1.651.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aliyun.www:aliyun-container-service-deploy =0.1.0, =y, =1.0.4, =1.004, =1.0, =1.0.6,...
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (2.22.0-beta-1), io.jenkins.plugins:screenrecorder (>=0.3, <=0.7) +14 more potentially affected by CVE-2020-2221 via org.jenkins-ci.main:jenkins-core (1.625)
org.jenkins-ci.main:jenkins-core MAVEN version 1.625 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger 2.22.0-beta-1 -...
com.coravy.hudson.plugins.github:github (>=0.5, <=0.8), com.sonyericsson.hudson.plugins.gerrit:build-config (>=1.2.2, <=1.2.9) +34 more potentially affected by CVE-2020-2220 via org.jenkins-ci.main:jenkins-core (1.400)
org.jenkins-ci.main:jenkins-core MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =0.5, =1.2.2, =1.2.2, =2.3.0, =1.4, =1.8, =1.10, =0.1.2...
org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2020-2220 via org.jenkins-ci.main:jenkins-core (1.581)
org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...
GHSA-RJJQ-63C7-8724 CSRF vulnerability in Jenkins P4 Plugin
A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce...
GHSA-F9V6-P7HP-C3QX Missing permission checks in Jenkins P4 Plugin
A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints...
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.8.0, <=2.10.1) potentially affected by CVE-2020-2136 via org.jenkins-ci.plugins:git (1.2.0)
org.jenkins-ci.plugins:git MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger =2.8.0, =2.10.1 Source cves: CVE-2020-2136 Source...
com.coravy.hudson.plugins.github:github (>=0.5, <=0.8), com.sonyericsson.hudson.plugins.gerrit:build-config (>=1.2.2, <=1.2.9) +34 more potentially affected by CVE-2020-2105 via org.jenkins-ci.main:jenkins-core (1.400)
org.jenkins-ci.main:jenkins-core MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =0.5, =1.2.2, =1.2.2, =2.3.0, =1.4, =1.8, =1.10, =0.1.2...
org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2020-2100 via org.jenkins-ci.main:jenkins-core (1.581)
org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...
org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2020-2101 via org.jenkins-ci.main:jenkins-core (1.581)
org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (2.22.0-beta-1), io.jenkins.plugins:screenrecorder (>=0.3, <=0.7) +14 more potentially affected by CVE-2020-2104 via org.jenkins-ci.main:jenkins-core (1.625)
org.jenkins-ci.main:jenkins-core MAVEN version 1.625 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger 2.22.0-beta-1 -...
com.nirima:docker-plugin (>=0.9-beta1, <=0.13.0), com.nirima:docker-plugin-parent (>=0.9-beta1, <=0.13.0) +26 more potentially affected by CVE-2020-2102 via org.jenkins-ci.main:jenkins-core (1.565.3)
org.jenkins-ci.main:jenkins-core MAVEN version 1.565.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima:docker-plugin =0.9-beta1, =0.9-beta1, =2.13.0-beta-2, =1.0, =1.0, =1.0, =0.1.0,...
com.coravy.hudson.plugins.github:github (>=0.5, <=0.8), com.sonyericsson.hudson.plugins.gerrit:build-config (>=1.2.2, <=1.2.9) +34 more potentially affected by CVE-2020-2099 via org.jenkins-ci.main:jenkins-core (1.400)
org.jenkins-ci.main:jenkins-core MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =0.5, =1.2.2, =1.2.2, =2.3.0, =1.4, =1.8, =1.10, =0.1.2...
Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...
GHSA-4R39-F4RH-J6Q8 Missing permission check in Jenkins Gerrit Trigger Plugin
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...
Missing permission check in Jenkins Gerrit Trigger Plugin
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins maste...
GHSA-VMVP-2HHX-RGM8 Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...