Archive
January 2023
Vulnerabilities first published in this month (UTC), newest first.
2,382 results · Feed
-
Medium 5.5
Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 4.3
Cisco Spark Notifier Jenkins Plugin contains Missing Authorization
A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.1
Open redirect vulnerability in Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
-
Medium 6.5
Cross-site request forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
-
Medium 6.1
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
-
Medium 6.1
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
-
Critical 9.8
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
-
High 8.1
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
-
Medium 5.5
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due t…
-
Medium 6.8
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to l…
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
High 7.8
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into en…
-
High 7.8
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on start…
-
High 7.8
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without us…
-
Medium 5.5
In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could le…
-
High 7.8CVE-2023-20904 Public exploit
In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mism…
-
High 7.8
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.3CVE-2023-20921 Public exploit
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility se…
-
High 7.8
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. T…
-
High 7.8
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due…
-
High 7.8
In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. Th…
-
High 7.8
In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to loca…
-
Medium 5.5
In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This coul…
-
Medium 5.4
Reflected XSS B2B Dealer Ordering System
B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347.
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to c…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…
-
High 7.8
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivilege…
-
High 7.8
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which c…
-
Medium 6.5
Authenticated denial of service
Authenticated denial of service
-
High 7.5
Unauthenticated denial of service
Unauthenticated denial of service
-
High 8.8
SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privilege…
-
Medium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 1…
-
Critical 9.3
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting f…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.…
-
Medium 5.3
An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4…
-
High 7.8CVE-2022-45639 Public exploit
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cr…
-
Medium 6.5
An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing p…
-
Critical 9.8
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary comman…