‼ CVE-2022-43420 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43434 ‼
📖 Read
via "National Vulnerability Database".
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43435 ‼
📖 Read
via "National Vulnerability Database".
Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43426 ‼
📖 Read
via "National Vulnerability Database".
Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43430 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43408 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43418 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43422 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43427 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43414 ‼
📖 Read
via "National Vulnerability Database".
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified directory on the Jenkins controller.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43413 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43407 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43401 ‼
📖 Read
via "National Vulnerability Database".
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-43424 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43416 ‼
📖 Read
via "National Vulnerability Database".
Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attackers able to control agent processes to invoke Katalon on the Jenkins controller with attacker-controlled version, install location, and arguments, and attackers additionally able to create files on the Jenkins controller (e.g., attackers with Item/Configure permission could archive artifacts) to invoke arbitrary OS commands.📖 Read
via "National Vulnerability Database".
🕴 Apache Commons Vulnerability: Patch but Don't Panic 🕴
📖 Read
via "Dark Reading".
Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.📖 Read
via "Dark Reading".
Dark Reading
Apache Commons Vulnerability: Patch but Don't Panic
Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.
🕴 Scammers Targeting Those Seeking Student Loan Forgiveness 🕴
📖 Read
via "Dark Reading".
FBI warns that cybercriminals are stealing personal information by posing as administrators of the Student Loan Debt Relief Plan.📖 Read
via "Dark Reading".
Dark Reading
Scammers Targeting Those Seeking Student Loan Forgiveness
FBI warns that cybercriminals are stealing personal information by posing as administrators of the Student Loan Debt Relief Plan.
‼ CVE-2022-41708 ‼
📖 Read
via "National Vulnerability Database".
Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40884 ‼
📖 Read
via "National Vulnerability Database".
Bento4 1.6.0 has memory leaks via the mp4fragment.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43029 ‼
📖 Read
via "National Vulnerability Database".
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43016 ‼
📖 Read
via "National Vulnerability Database".
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.📖 Read
via "National Vulnerability Database".