CVE Vulnerability Catalog

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can allow malicious repositories to modify files outside the repository.

A vulnerability in the Linux kernel related to memory corruption that occurs when switching the path from UFO to non-UFO. The issue arises when UFO packet lengths exceed MTU, leading to negative values in calculations and writing out-of-bounds.

The Linux kernel has a heap out-of-bounds vulnerability in AF_PACKET sockets. This issue is analogous to the previously disclosed CVE-2016-8655, where a socket option changing socket state may race with safety checks.

The Input Step Plugin in Pipeline by default allowed users with Item/Read access to interact with the step to provide input. This has been changed to now require Item/Build permission instead.

The Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could lead to invoking arbitrary constructors and methods, bypassing sandbox protection.

Blue Ocean allows the creation of GitHub organization folders that scan for repositories and branches containing a Jenkinsfile and create corresponding pipelines in Jenkins. The SCM content REST API did not check the current user's authentication or credentials, leading to unauthorized access.

The Request.ParseMultipartForm method of the net/http package starts writing to temporary files once the request body size exceeds the specified 'maxMemory' limit. An attacker could craft a multipart request such that the server would run out of file descriptors.

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

Due to incomplete sandbox protection, arbitrary code execution is possible in Pipeline scripts. Constructors, instance variable initializers, and instance initializers were not subject to sandbox protection, allowing arbitrary code execution by Jenkins users with appropriate permissions.

The Poll SCM Plugin did not require requests to its API to be sent via POST, thereby exposing it to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name.

The Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL, resulting in the Jenkins Git client sending the username and password to an attacker-controlled server.

The Role-based Authorization Strategy Plugin did not require requests to its API to be sent via POST, thereby exposing it to Cross-Site Request Forgery attacks. This allowed attackers to add administrator roles to any user or remove the authorization configuration, preventing legitimate access to Jenkins.

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.

In capi-release versions of Cloud Foundry from 1.33.0 to 1.41.0 and cf-release from 268 to 273, an API regression allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application.

A flaw in the AIX 5.3, 6.1, 7.1, and 7.2 JRE/SDK installp and updatep packages prevented the java.security, java.policy, and javaws.policy files from being updated correctly.

The named pipes in qtsingleapp in Qt 5.x, used in qBittorrent and SugarSync, are configured for remote access, allowing remote attackers to cause application crashes via an unspecified string.

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

In Gemalto's HASP SRM, Sentinel HASP, and Sentinel LDK products prior to version 7.55 RTE, there is a vulnerability that allows arbitrary memory read from a controlled memory pointer, leading to remote denial of service.

Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.