CVE-2020-2239

Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

CVE-2020-2239

The CVE-2020-2239 issue affects Jenkins Parameterized Remote Trigger Plugin up to version 3.1.3. The plugin stores a secret in plaintext in the controller’s global configuration file (org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml), exposing confidential data to any...

PT-2020-15459 · Jenkins · Jenkins Parameterized Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Parameterized Remote Trigger Plugin versions 3.1.3 and earlier Description: The issue concerns the storage of a secret in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the secret is...

Mozilla: Attacker-induced prompt for extension installation

By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...

An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command a memory leak may occur.

...

New Relic: Adding your account to victim's app via deeplink

At your android app, there is a feature for passwordless login. It sends an email and if you click the link, it triggers a deeplink on the app for login. I think this feature needs a state control, for example setting loginstatetoken=ABC on the requester device and adding this loginstatetoken to...

FreeBSD : jenkins -- multiple vulnerabilities (eef0d2d9-78c0-441e-8b03-454c5baebe20)

Jenkins Security Advisory : DescriptionHigh SECURITY-1955 / CVE-2020-2229 Stored XSS vulnerability in help icons High SECURITY-1957 / CVE-2020-2230 Stored XSS vulnerability in project naming strategy High SECURITY-1960 / CVE-2020-2231 Stored XSS vulnerability in 'Trigger builds remotely' C Tenabl...

CVE-2020-7301

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section...

Cross site scripting

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting XSS vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Toke...

CVE-2020-2231

Vulnerability summary (CVE-2020-2231) : Jenkins < 2.252 and LTS

The vulnerability of the Red Hat Process Automation Manager system, related to uncontrolled resource consumption, allows a perpetrator to trigger a service failure in the target system.

The vulnerability of the Red Hat Process Automation Manager system is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures in the target system by sending specially crafted HTTP packets remotely...

PT-2020-15452 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.251 and earlier Jenkins LTS versions 2.235.3 and earlier Description: The issue results from the failure to escape the remote address of the host starting a build via 'Trigger builds remotely', leading to a stored cross-sit...

CVE-2020-14313

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace...

CVE-2020-14313

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace...

Information disclosure

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace...

Exploit for Improper Input Validation in Microsoft

PoC exploit for CVE-2020-1350, a Windows DNS DoS vulnerability. The target product/service is Windows DNS server, and the vulnerability class/vector is a denial-of-service DoS attack. The probable entry point is the sigreddos.py script, which listens on port 53 on both TCP and UDP. Notable...

Memory corruption

An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A specially crafted Diameter request can trigger a memory corruption resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability...

The vulnerability of the Cisco NX-OS operating system, related to bypassing authentication through spoofing, allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco NX-OS operating system is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow a malicious actor to trigger a service failure remotely...

Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS

Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...

SUSE SLES12 Security Update : systemd (SUSE-SU-2020:1842-1)

This update for systemd fixes the following issues : CVE-2019-20386: Fixed a memory leak when executing the udevadm trigger command bsc1161436. Renamed the persistent link for ATA devices bsc1164538 shared/install: try harder to find enablement symlinks when disabling a unit bsc1157315 tmpfiles:...