All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-25962
https://security.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614
h…
Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example “../../../e…
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-47042
https://gitee.com/mingSoft/MCMS/issues/I6592F
https://…
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and…
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
References
https://nvd.nist.gov/vuln/detail/CVE-2023-24427
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2982
https://github.com/jenkins…
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
References
https://nvd.nist.gov/vuln/detail/CVE-202…
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
https://nvd.nist.gov/vuln/detail/CVE-2023-24430
https://www.jenkins.io/security/advisory/2023-01-24/#SECURIT…
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
References
https://nvd.nist.gov/vuln/detail/CVE-2023-24424
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2978
https://githu…
In September 2021, security researchers discovered a malicious Composer package called symfont/process, a typosquat targeting users of symfony/process. The malicious package has since been removed from Packagist.
References
https://github.com/FriendsO…
Impact
A command injection vulnerability was discovered in Wrangler’s Git package affecting versions up to and including v1.0.0.
Wrangler’s Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. …
