3923 matches found
org.jenkins-ci.plugins:gerrit-verify-status-reporter (>=0.0.2, <=0.0.3), org.jenkins-ci.plugins:msginject (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2018-1000105 via com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.14.0, <=2.22.0)
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger MAVEN version =2.14.0, =0.0.2, =0.1.0, =1.0, =2.4.6 Source cves: CVE-2018-1000105 Source advisory: GHSA-WRQC-Q8P5-76M5...
Incorrect Authorization in Jenkins Gerrit Trigger Plugin
An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins...
GHSA-4VF2-CM23-RF4C Incorrect Authorization in Jenkins Gerrit Trigger Plugin
An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins...
Parameterized Trigger Plugin fails to check Item/Build permission
Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. The plugin has been adapted to now check for Item/Build permission before triggering a...
GHSA-MC22-25R3-2W9W Parameterized Trigger Plugin fails to check Item/Build permission
Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. The plugin has been adapted to now check for Item/Build permission before triggering a...
org.jenkins-ci.main:jenkins-test-harness (1.581), org.jenkins-ci.main:jenkins-war (1.581) +5 more potentially affected by CVE-2017-2613 via org.jenkins-ci.main:jenkins-core (1.581)
org.jenkins-ci.main:jenkins-core MAVEN version 1.581 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.581 - org.jenkins-ci.main:jenkins-war 1.581 -...
org.jenkins-ci.main:jenkins-test-harness (1.524), org.jenkins-ci.main:jenkins-war (1.524) +5 more potentially affected by CVE-2017-1000400 via org.jenkins-ci.main:jenkins-core (1.524)
org.jenkins-ci.main:jenkins-core MAVEN version 1.524 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.524 - org.jenkins-ci.main:jenkins-war 1.524 -...
org.jenkins-ci.main:jenkins-test-harness (1.586), org.jenkins-ci.main:jenkins-war (1.586) +5 more potentially affected by CVE-2017-1000400 via org.jenkins-ci.main:jenkins-core (1.586)
org.jenkins-ci.main:jenkins-core MAVEN version 1.586 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.586 - org.jenkins-ci.main:jenkins-war 1.586 -...
Missing permission checks in Jenkins Periodic Backup Plugin allow every user to change settings
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to it...
com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (2.22.0-beta-1), io.jenkins.plugins:screenrecorder (>=0.3, <=0.7) +14 more potentially affected by CVE-2018-1999002 via org.jenkins-ci.main:jenkins-core (1.625)
org.jenkins-ci.main:jenkins-core MAVEN version 1.625 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger 2.22.0-beta-1 -...
com.gurkensalat.jenkins-ci.plugins:transifex (0.1.0), com.rubiconred.jenkins:myst-plugin (>=2.4.3.1, <=2.5.0.0) +39 more potentially affected by CVE-2018-1000194 via org.jenkins-ci.main:jenkins-core (1.509.3)
org.jenkins-ci.main:jenkins-core MAVEN version 1.509.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.gurkensalat.jenkins-ci.plugins:transifex 0.1.0 - com.rubiconred.jenkins:myst-plugin...
CVE-2022-26510
A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability...
CVE-2021-34605
A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an uplo...
CVE-2021-26384
A malformed SMI System Management Interface command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources...
CVE-2022-28901
A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1FW130B06 allows attackers to escalate privileges to root via a crafted payload...
CVE-2022-28599
A stored cross-site scripting XSS vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack...
Design/Logic Flaw
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions such as reset whi...
CVE-2022-28054
Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...