Archive
18 March 2021
Vulnerabilities first published on this day (UTC), newest first.
9 results · Clear filters · Feed
-
Medium 6.3
Null characters not escaped in shescape
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an …
-
Medium 5.3
exacqVision Web Services - Information Exposure
A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.
-
Medium 5.4
Concrete CMS Cross-site Scripting via Survey Blocks
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
-
Medium 6.1
Cross-Site Scripting in Qiita-Markdown
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
-
Medium 4.3
Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attack…
-
Medium 4.3
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circ…
-
Medium 4.3
Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items
An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
-
Medium 6.5
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.
-
Medium 5.3
In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication
Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't al…