CVE-2023-32981

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content...

CVE-2023-32981

The CVE-2023-32981 entry corresponds to an arbitrary file write vulnerability in the Jenkins Pipeline Utility Steps Plugin (versions up to 2.15.2). Connected Red Hat advisories RHSA-2023-3625 and RHSA-2023-3663 explicitly list CVE-2023-32981 as a vulnerability in the Jenkins/jenkins-2-plugins sta...

com.btc.ep:btc-embeddedplatform (>=2.5.8, <=2.5.9), org.jenkins-ci.plugins:qmetry-for-jira-test-management (>=1.11, <=1.27) potentially affected by CVE-2023-32981 via org.jenkins-ci.plugins:pipeline-utility-steps (1.1.1)

org.jenkins-ci.plugins:pipeline-utility-steps MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-utility-steps and may be impacted: - com.btc.ep:btc-embeddedplatform =2.5.8, =1.11, =1.27 Source cves:...

CVE-2023-32981

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content...

Lancefly APT Group Deploys Custom Backdoor ‘Merdoor’ in Targeted Attacks

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Lancefly APT group targets South and Southeast Asia using the Merdoor backdoor and an updated ZXShell rootkit. Their attack chain involves credential theft, lateral movement, file staging, and...

Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2023-32981: Out-of-bounds Write

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content...

Jenkins Plugin Pipeline Utility Steps 缓冲区错误漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Pipeline is a suite of plugins that support the implementation and integration of continuous delivery pipelines int...

Arbitrary file write vulnerability on agents in pipeline-utility-steps

pipeline-utility-steps provides the untar and unzip Pipeline steps to extract archives into job workspaces. pipeline-utility-steps 2.15.2 and earlier does not validate or limit file paths of files contained within these archives. This allows attackers able to provide crafted archives as parameter...

ALSA-2023:3106 Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: FTP too eager connection reuse CVE-2023-27535 For more details about the security issues, including the impact, a CVS...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K000132768)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.4 / 15.1.8.2 / 16.1.3.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K000132768 advisory. - A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configurati...

Possible URL spoofing on wildcard path

Description H3 provides the getRequestURL utility using the new URLa, b constructor. When variable a is attacker-controlled the origin of the resulting URL can be modified. Proof of Concept js // index.js import listen from "listhen"; import createApp, createRouter, eventHandler, toNodeListener,...

SUSE CVE-2015-3673

Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility...

EulerOS 2.0 SP9 : apr-util (EulerOS-SA-2023-1860)

According to the versions of the apr-util package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write...

EulerOS 2.0 SP9 : apr-util (EulerOS-SA-2023-1835)

According to the versions of the apr-util package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write...

F5 Networks BIG-IP : BIG-IP Configuration utility XSS vulnerability (K000132726)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.4 / 15.1.8.2 / 16.1.3.4 / 17.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000132726 advisory. - Multiple reflected cross-site scripting XSS vulnerabilities exist in undisclosed pages of...

CVE-2023-2647

A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utilityall.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The...

Weaver E-Office 命令注入漏洞

Weaver E-Office is a collaborative office system from China's Panavision Technologies Weaver. A command injection vulnerability exists in Weaver E-Office version 9.5, which stems from a problem in the file /webroot/inc/utilityall.php that can lead to command injection...

PT-2023-20660 · Unknown · Weaver E-Office

Name of the Vulnerable Software and Affected Versions: Weaver E-Office version 9.5 Description: A critical issue was found in the File Upload Handler component, specifically in the /webroot/inc/utility all.php file, which leads to command injection. This issue can be exploited remotely. The vendo...