‼ CVE-2022-34206 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34180 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34188 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34212 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34296 ‼
📖 Read
via "National Vulnerability Database".
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33027 ‼
📖 Read
via "National Vulnerability Database".
LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-33124 ‼
📖 Read
via "National Vulnerability Database".
aiohttp v3.8.1 was discovered to contain an invalid IPv6 URL which can lead to a Denial of Service (DoS).📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-34210 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34173 ‼
📖 Read
via "National Vulnerability Database".
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34187 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34177 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34174 ‼
📖 Read
via "National Vulnerability Database".
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32126 ‼
📖 Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34208 ‼
📖 Read
via "National Vulnerability Database".
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-34170 ‼
📖 Read
via "National Vulnerability Database".
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.📖 Read
via "National Vulnerability Database".
🕴 Johnson Controls Acquires Tempered Networks to Bring Zero Trust Cybersecurity to Connected Buildings 🕴
📖 Read
via "Dark Reading".
Johnson Controls will roll out the Tempered Networks platform across deployments of its OpenBlue AI-enabled platform.📖 Read
via "Dark Reading".
Dark Reading
Johnson Controls Acquires Tempered Networks to Bring Zero Trust Cybersecurity to Connected Buildings
Johnson Controls will roll out the Tempered Networks platform across deployments of its OpenBlue AI-enabled platform.
🕴 Chinese APT Group Likely Using Ransomware Attacks as Cover for IP Theft 🕴
📖 Read
via "Dark Reading".
Bronze Starlight’s use of multiple ransomware families and its victim-targeting suggest there’s more to the group’s activities than just financial gain, security vendor says.📖 Read
via "Dark Reading".
Dark Reading
Chinese APT Group Likely Using Ransomware Attacks as Cover for IP Theft
Bronze Starlight’s use of multiple ransomware families and its victim-targeting suggest there’s more to the group’s activities than just financial gain, security vendor says.
‼ CVE-2022-26863 ‼
📖 Read
via "National Vulnerability Database".
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2183 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26862 ‼
📖 Read
via "National Vulnerability Database".
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26864 ‼
📖 Read
via "National Vulnerability Database".
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.📖 Read
via "National Vulnerability Database".