Page 5 of 1626 results (0.005 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token. El complemento Jenkins GitLab Branch Source 684.vea_fa_7c1e2fe3 y versiones anteriores utiliza una función de comparación de tiempo no constante al verificar si el token de webhook proporcionado y el esperado son iguales, lo que potencialmente permite a los atacantes usar métodos estadísticos para obtener un token de webhook válido. • http://www.openwall.com/lists/oss-security/2024/01/24/6 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-2871 • CWE-697: Incorrect Comparison •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL. Una vulnerabilidad de cross-site request forgery (CSRF) en el complemento Jenkins GitLab Branch Source 684.vea_fa_7c1e2fe3 y versiones anteriores permite a los atacantes conectarse a una URL especificada por el atacante. • http://www.openwall.com/lists/oss-security/2024/01/24/6 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3251 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. El complemento Jenkins GitLab Branch Source 684.vea_fa_7c1e2fe3 y anteriores descubre incondicionalmente proyectos que se comparten con el grupo propietario configurado, lo que permite a los atacantes configurar y compartir un proyecto, lo que da como resultado que Jenkins cree una canalización manipulada durante el siguiente análisis del grupo. • http://www.openwall.com/lists/oss-security/2024/01/24/6 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040 •

CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers. El complemento Jenkins Matrix Project 822.v01b_8c85d16d2 y versiones anteriores no sanitiza los nombres de eje definidos por el usuario de proyectos de configuración múltiple, lo que permite a los atacantes con permiso Elemento/Configurar crear o reemplazar cualquier archivo config.xml en el sistema de archivos del controlador Jenkins con contenido no controlable por los atacantes. A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system with content not controllable by the attackers. • http://www.openwall.com/lists/oss-security/2024/01/24/6 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289 https://access.redhat.com/security/cve/CVE-2024-23900 https://bugzilla.redhat.com/show_bug.cgi?id=2260184 • CWE-23: Relative Path Traversal •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system. El complemento del servidor Jenkins Git 99.va_0826a_b_cdfa_d y versiones anteriores no desactiva una función de su analizador de comandos que reemplaza un carácter '@' seguido de una ruta de archivo en un argumento con el contenido del archivo, permitiendo a atacantes con permiso general/lectura leer contenido de archivos arbitrarios en el sistema de archivos del controlador Jenkins. A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system. • http://www.openwall.com/lists/oss-security/2024/01/24/6 https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319 https://access.redhat.com/security/cve/CVE-2024-23899 https://bugzilla.redhat.com/show_bug.cgi?id=2260183 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •