91 matches found
CVE-2023-25721
Veracode Scan Jenkins Plugin exposes proxy credentials in logs for versions prior to 23.3.19.0 when proxy is used with credentials and Jenkins global debug is enabled, and a scan runs on remote agent jobs. The root cause is information disclosure in job logs accessible to users who can view logs,...
CVE-2023-25721
Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users with access to view the job log to...
Exploit for Improper Input Validation in Snakeyaml_Project Snakeyaml
SnakeYAML-CVE-2022-1471-POC Code for veracode blog To demonst...
Jenkins veracode-scanner Plugin stores credentials in plain text
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.veracodescanner.VeracodeNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...
GHSA-5722-V5WC-X7H8 Jenkins veracode-scanner Plugin stores credentials in plain text
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.veracodescanner.VeracodeNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...
encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-0430 via httpie (1.0.3)
httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-0430 Source advisory:...
encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-0430 via httpie (1.0.3)
httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-0430 Source advisory:...
encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-24737 via httpie (1.0.3)
httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-24737 Source advisory:...
encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-24737 via httpie (1.0.3)
httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-24737 Source advisory:...
Apache Log4j Remote Code Execution
Impact Opencast uses an Apache Log4j2 version which, combined with older JDK versions, can be used for remote code execution attacks which have been found to be actively exploited. Apache Log4j2 =2.14.1 JNDI features is not sufficiently protected. An attacker who can control log messages or log...
“Hacker Games” launched to challenge and improve cybersecurity skills
By Habiba Rashid Launched by Veracode; Hacker Games will last for 2 weeks March 15-26, 2021. This is a post from HackRead.com Read the original post: “Hacker Games” launched to challenge and improve cybersecurity skills...
70 Percent of Mobile, Desktop Apps Contain Open-Source Bugs
A full 70 percent of applications being used today have at least one security flaw stemming from the use of an open-source library. According to Veracode’s annual State of Software Security report, these open-source libraries – free, centralized code repositories that provide ready-made applicati...
Homemade TEMPEST Receiver
Tom's Guide writes about home brew TEMPEST receivers: Today, dirt-cheap technology and free software make it possible for ordinary citizens to run their own Tempest programs and listen to what their own -- and their neighbors' -- electronic devices are doing. Elliott, a researcher at Boston-based...
CloudBees Jenkins veracode-scanner Plugin Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . veracode-scanner Plugin is used in one...
Nextcloud: Veracode and security audit record are publicly available
Leakage of sensitive data through open endpoint Risk management and Compliance Document written by NCC Here is what the document says: 𝘗𝘳𝘰𝘱𝘳𝘪𝘦𝘵𝘢𝘳𝘺 𝘐𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯 𝘛𝘩𝘪𝘴 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵 𝘤𝘰𝘯𝘵𝘢𝘪𝘯𝘴 𝘥𝘦𝘵𝘢𝘪𝘭𝘦𝘥 𝘤𝘰𝘮𝘮𝘦𝘳𝘤𝘪𝘢𝘭, 𝘧𝘪𝘯𝘢𝘯𝘤𝘪𝘢𝘭 𝘢𝘯𝘥 𝘭𝘦𝘨𝘢𝘭 𝘪𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯, 𝘸𝘩𝘪𝘤𝘩 𝘪𝘴 𝘤𝘰𝘯𝘧𝘪𝘥𝘦𝘯𝘵𝘪𝘢𝘭 𝘢𝘯𝘥 𝘤𝘰𝘮𝘮𝘦𝘳𝘤𝘪𝘢𝘭𝘭𝘺 𝘴𝘦𝘯𝘴𝘪𝘵𝘪𝘷𝘦. 𝘛𝘩𝘦 𝘳𝘦𝘭𝘦𝘢𝘴𝘦...
Microsoft Outlook for Android Open to XSS Attacks
Microsoft has patched a vulnerability in Microsoft Outlook for Android, which opens the door to cross-site scripting XSS attacks. The software giant said that CVE-2019-1105, rated “important,” is a spoofing vulnerability that exists in the way Microsoft Outlook for Android software parses...
CVE-2019-1003070
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
Design/Logic Flaw
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
