CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10176 – atomic-openshift: CSRF tokens not refreshing while user is logged in and are exposed in the URL
https://notcve.org/view.php?id=CVE-2019-10176
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack. Se detectó un fallo en OpenShift Container Platform, versiones 3.11 y posteriores, en la que se encontró que los tokens CSRF usados en el componente cluster console permanecían estáticos durante la sesión de un usuario. Un atacante con la capacidad de observar el valor de este token podría ser capaz de reutilizar el token para realizar un ataque de tipo CSRF. • https://access.redhat.com/errata/RHSA-2019:2792 https://access.redhat.com/errata/RHSA-2019:4053 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10176 https://access.redhat.com/security/cve/CVE-2019-10176 https://bugzilla.redhat.com/show_bug.cgi?id=1712569 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10355 – jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin
https://notcve.org/view.php?id=CVE-2019-10355
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts. Una vulnerabilidad de omisión del sandbox en el Plugin Script Security de Jenkins versión 1.61 y anteriores, relacionada con el manejo de conversiones de tipos permitió a los atacantes ejecutar código arbitrario en scripts del sandbox. A flaw was found in Jenkins Script Security plugin. Sandbox protection could be circumvented by casting crafted objects to other types allowing an attacker to specify sandboxed scripts to invoke constructors that weren't previously whitelisted. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. • http://www.openwall.com/lists/oss-security/2019/07/31/1 https://access.redhat.com/errata/RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:2651 https://access.redhat.com/errata/RHSA-2019:2662 https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%281%29 https://access.redhat.com/security/cve/CVE-2019-10355 https://bugzilla.redhat.com/show_bug.cgi?id=1735515 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10357 – jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin
https://notcve.org/view.php?id=CVE-2019-10357
A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries. Una falta de comprobación de permisos en el Plugin Shared Groovy Libraries de Jenkins Pipeline versión 2.14 y anteriores, permitió a los usuarios con acceso General y de Lectura obtener información limitada sobre el contenido de los repositorios SCM referenciados mediante las bibliotecas globales. • http://www.openwall.com/lists/oss-security/2019/07/31/1 https://access.redhat.com/errata/RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:2651 https://access.redhat.com/errata/RHSA-2019:2662 https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422 https://access.redhat.com/security/cve/CVE-2019-10357 https://bugzilla.redhat.com/show_bug.cgi?id=1735521 • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10356 – jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin
https://notcve.org/view.php?id=CVE-2019-10356
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts. Una vulnerabilidad de omisión de sandbox en el Plugin Script Security de Jenkins versión 1.61 y anteriores, relacionada con el manejo de expresiones de puntero de método permitió a los atacantes ejecutar código arbitrario en scripts del sandbox. A flaw was found in the Jenkins Script Security plugin. Sandbox protection could be circumvented through crafted subexpressions used as arguments to method pointer expressions. This allows attackers the ability to specify sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM. • http://www.openwall.com/lists/oss-security/2019/07/31/1 https://access.redhat.com/errata/RHSA-2019:2594 https://access.redhat.com/errata/RHSA-2019:2651 https://access.redhat.com/errata/RHSA-2019:2662 https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%282%29 https://access.redhat.com/security/cve/CVE-2019-10356 https://bugzilla.redhat.com/show_bug.cgi?id=1735518 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 61EXPL: 0CVE-2019-14379 – jackson-databind: default typing mishandling leading to remote code execution
https://notcve.org/view.php?id=CVE-2019-14379
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. El archivo SubTypeValidator.java en jackson-databind de FasterXML en versiones anteriores a la 2.9.9.2 maneja inapropiadamente la escritura predeterminada cuando se usa ehcache (debido a net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), lo que conlleva a la ejecución de código remoto. A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code. • http://seclists.org/fulldisclosure/2022/Mar/23 https://access.redhat.com/errata/RHBA-2019:2824 https://access.redhat.com/errata/RHSA-2019:2743 https://access.redhat.com/errata/RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2935 https://access.redhat.com/errata/RHSA-2019:2936 https://access.redhat.com/errata/RHSA-2019:2937 https://access.redhat.com/errata/RHSA-2019:2938 https://access.redhat.com/errata/RHSA-2019:2998 https://access.redhat.com/errata/RHSA-2 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •