com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25183 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25182 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25180 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25180 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25177 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25177 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25176 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25176 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25174 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25174 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25173 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25173 Source advisory:...

Sensitive information disclosure in workflow-cps

workflow-cps 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. workflow-cps 2656.vf7ae7b75a457 does not allow...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrar...

com.testinium.jenkins:testinium (1.0), io.fabric8.jenkins.plugins:openshift-sync (>=0.9.1, <=1.0.45) +35 more potentially affected by CVE-2022-25179 via org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.13, <=2.20)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version =1.13, =0.9.1, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-1, =1.1.0-beta-4, =1.0-alpha-1, =2.2.0, =2.0, =2.0, =2.6 and more Source cves: CVE-2022-25179 Source advisor...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted...

io.jenkins.plugins:synopsys-sigma (>=2021.12.0, <=2022.1.0) potentially affected by CVE-2022-25179 via org.jenkins-ci.plugins.workflow:workflow-multibranch (2.24)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-multibranch and may be impacted: - io.jenkins.plugins:synopsys-sigma =2021.12.0, =2022.1.0...

CVE-2021-43929

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

argo:fuzz_workflow_controller: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4815348191330304 Project: argo Fuzzing Engine: libFuzzer Fuzz Target: fuzzworkflowcontroller Job Type: libfuzzerasanargo Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00001c1df21e Crash State: NULL Sanitizer: address ASAN Recommend...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

pwnKit About: Title: pwnKit Description: Privilege esc...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

Security Bulletin: Denial of Service vulnerability in sanitize-html affects IBM Business Automation Workflow (CVE-2021-23382)

Summary A denial of service vulnerability in sanitize-html affects IBM Business Automation Workflow Workflow Center. Vulnerability Details CVEID: CVE-2021-23382 DESCRIPTION: Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service ReDoS flaw in...

Security Bulletin: Vulnerabilities in Node.js affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-22960, CVE-2021-22959

Summary Configuration Editor in IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a HTTP request smuggling attack. Vulnerability Details CVEID: CVE-2021-22960 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error when parsing the body o...