PT-2019-16859

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow and IBM Business Process Manager versions 18.0.0.0 through 18.0.0.2 Description The issue is related to a missing restriction in an API, which could allow a client to spoof the last modified by value of a...

PT-2019-9956

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow versions 18.0.0.0 through 18.0.0.2 Description The issue could reveal sensitive version information about the server from error pages, potentially aiding an attacker in further attacks against the system...

CVE-2019-1003041

A flaw was found in the Jenkins Workflow CPS plugin. Groovy Plugins could be circumvented through methods supporting type casts and type coercion allowing attackers to invoke constructors for arbitrary types. The highest threat from this vulnerability is to data confidentiality and integrity as...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +91 more potentially affected by CVE-2019-1003041 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.56)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2019-1003041 Source advisory:...

CVE-2019-1003030

A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...

How to Mature Your Threat Hunting Program with the ATT&CK™ Framework

John Wunder, Principal Cybersecurity Engineer at MITRE spoke in a recent webinar about how the ATT&CK framework is a knowledgebase of adversary behaviors, describing the things that are tough for the adversary to change – those at the top of David J. Bianco’s influential Pyramid of Pain. Wunder...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +91 more potentially affected by CVE-2019-1003030 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.56)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2019-1003030 Source advisory:...

Workflow Component Unauthorized Access

The vulnerability of the Workflow component of the Oracle PeopleSoft Enterprise PeopleTools business application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP...

Rundeck Community Edition Cross Site Scripting

Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting

Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...

Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)

org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.2.0-beta-1) +19 more potentially affected by CVE-2019-1003002 via org.jenkinsci.plugins:pipeline-model-definition (>=0.1, <=1.3.2)

org.jenkinsci.plugins:pipeline-model-definition MAVEN version =0.1, =1.0.0-b02, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =0.1-preview-1, =2.0.7, =1.0, =1.1.0, =1.0.0, =1.5.5 and more Source cves: CVE-2019-1003002 Source advisory: MEND:CVE-2019-1003002...

SQL Injection Vulnerabilities Exist in Many Places in Yuanheng Times Workflow Engine System

Beijing Yuanheng Times Technology Co., Ltd. is the first full-service IT service provider in China to launch a collaboration management system based on Microsoft SharePoint platform. SQL injection vulnerability exists in many places in the workflow engine system of Yuanheng Times, which can be...

SugarCRM (WorkFlow module) PHP Code Injection Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...

Fedora 29 : php-symfony4 (2018-84a1f77d89)

Version 4.1.9 2018-12-06 - security CVE-2018-19790 Security\Http detect bad redirect targets using backslashes @xabbuh - security CVE-2018-19789 Form Filter file uploads out of regular form types @nicolas-grekas - bug 29436 Cache Fixed Memcached adapter doClearto call flush raitocz - bug 29441...

SugarCRM WorkFlow PHP Code Injection Vulnerability

SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...

SugarCRM (WorkFlow module) PHP Code Injection Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...