Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-41899 State: PUBLISHED Published: 2023-10-19T22:18:31.224Z Last Updated: 2024-09-12T15:10:42.201Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: home-assistant Products: core Problem Types: CWE-918 Description: Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This iss
attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-162`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-4r74-h49q-rr3h - https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp
CVE ID: CVE-2023-41900 State: PUBLISHED Published: 2023-09-15T20:17:42.201Z Last Updated: 2025-02-13T17:09:04.719Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: eclipse Products: jetty.project Problem Types: CWE-1390 Description: Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests
will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48 - https://github.com/eclipse/jetty.project/pull/9528 - https://github.com/eclipse/jetty.project/pull/9660 - https://www.debian.org/security/2023/dsa-5507 - https://security.netapp.com/advisory/ntap-20231110-0004/
CVE ID: CVE-2023-41901 State: REJECTED Published: N/A Last Updated: 2023-09-15T20:19:46.670Z Description: No description available.
CVE ID: CVE-2023-41902 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-25T14:15:47.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corecode.io/macupdater/history3.html - https://www.corecode.io/macupdater/history2.html - https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057
CVE ID: CVE-2023-41904 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-09-24T14:50:31.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-41904.html
CVE ID: CVE-2023-41905 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T19:09:49.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/securityadvisories
CVE ID: CVE-2023-41908 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T15:49:49.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cerebrate before 1.15 lacks the Secure attribute for the session cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cerebrate-project/cerebrate/commit/9be81055651649658243b5aa274b175064bfc6db - https://github.com/cerebrate-project/cerebrate/compare/v1.14...v1.15
CVE ID: CVE-2023-41909 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-08-02T19:09:49.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FRRouting/frr/pull/13222/commits/cfd04dcb3e689754a72507d086ba3b9709fc5ed8 - https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO
html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMJNX44SMJM25JZO7XWHDQCOB4SNJPIE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLG64IF3FU7V76K4TKCCXVNEE6P2VUDO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXR6PIVY4SWO7HDT4EY733H4X32SCPM4/
CVE ID: CVE-2023-41910 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:18:00.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lldpd/lldpd/releases/tag/1.0.17 - https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b - https://lists.debian.org/debian-lts-
- https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b - https://lists.debian.org/debian-lts-announce/2023/09/msg00025.html - https://www.debian.org/security/2023/dsa-5505
CVE ID: CVE-2023-41911 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-23T19:29:02.409Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AC:H/AV:L/A:H/C:N/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-41913 State: PUBLISHED Published: 2023-12-07T00:00:00.000Z Last Updated: 2025-11-04T19:21:10.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strongswan/strongswan/releases - https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.html - https://lists.fedoraproject.org/archive
ongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/
CVE ID: CVE-2023-41914 State: PUBLISHED Published: 2023-11-03T00:00:00 Last Updated: 2024-09-05T14:46:17.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://schedmd.com/security.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000100.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OWKTCYZT3DXEH66QXQJYB7NI7ONDRS4M/
CVE ID: CVE-2023-41915 State: PUBLISHED Published: 2023-09-09T00:00:00 Last Updated: 2024-08-02T19:09:49.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. Additional Analyst Notes: - CVE Program Container: References: - https://docs.openpmix.org/en/latest/security.html - https://github.com/openpmix/openpmix/releases/tag/v5.0.1 - https://github.com/openpmix/openpmix/releases/tag/v4.2.6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5X
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html - https://www.debian.org/security/2023/dsa-5547 - http://www.openwall.com/lists/oss-security/2024/07/10/3 - http://www.openwall.com/lists/oss-security/2024/07/10/4 - http://www.openwall.com/lists/oss-security/2024/07/10/6 - http://www.ope
.openwall.com/lists/oss-security/2024/07/10/4 - http://www.openwall.com/lists/oss-security/2024/07/10/6 - http://www.openwall.com/lists/oss-security/2024/07/11/3
CVE ID: CVE-2023-41916 State: PUBLISHED Published: 2024-07-15T07:53:57.843Z Last Updated: 2025-03-14T15:16:15.724Z Vendors: Apache Software Foundation Products: Apache Linkis DataSource Problem Types: CWE-552 Description: In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of
re it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of Linkis to version 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
CVE ID: CVE-2023-41917 State: PUBLISHED Published: 2024-07-02T07:41:28.397Z Last Updated: 2024-08-02T19:09:49.069Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-20 Description: Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41918 State: PUBLISHED Published: 2024-07-02T07:42:08.260Z Last Updated: 2024-08-02T19:09:49.350Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-306 Description: A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41919 State: PUBLISHED Published: 2024-07-02T07:42:16.318Z Last Updated: 2024-08-02T19:09:49.323Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-798 Description: Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41920 State: PUBLISHED Published: 2024-07-02T07:42:24.484Z Last Updated: 2024-08-02T19:09:49.386Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-305 Description: The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41921 State: PUBLISHED Published: 2024-07-02T07:42:33.722Z Last Updated: 2024-08-02T19:09:49.427Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-494 Description: A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
he target’s integrity to achieve an insecure state. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41922 State: PUBLISHED Published: 2024-07-02T07:42:42.031Z Last Updated: 2024-08-02T19:09:49.427Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-79 Description: A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
stances of Stored XSS vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41923 State: PUBLISHED Published: 2024-07-02T07:42:49.840Z Last Updated: 2024-08-02T19:09:49.428Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-521 Description: The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41926 State: PUBLISHED Published: 2024-07-02T07:43:16.362Z Last Updated: 2024-08-02T19:09:49.320Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-522 Description: The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41927 State: PUBLISHED Published: 2024-07-02T07:43:25.640Z Last Updated: 2024-08-02T19:09:49.292Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-327 Description: The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41928 State: PUBLISHED Published: 2024-07-02T07:43:31.998Z Last Updated: 2024-08-02T19:09:49.433Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Kiloview Products: P1/P2 Problem Types: CWE-327 Description: The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
CVE ID: CVE-2023-41929 State: PUBLISHED Published: 2023-09-18T00:00:00.000Z Last Updated: 2025-03-06T15:45:07.488Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows to exploit this vulnerability.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-41930 State: PUBLISHED Published: 2023-09-06T12:08:52.399Z Last Updated: 2024-09-26T19:59:09.503Z Vendors: Jenkins Project Products: Jenkins Job Configuration History Plugin Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3233 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41931 State: PUBLISHED Published: 2023-09-06T12:08:53.040Z Last Updated: 2024-09-26T19:58:39.502Z Vendors: Jenkins Project Products: Jenkins Job Configuration History Plugin Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3233 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41932 State: PUBLISHED Published: 2023-09-06T12:08:53.687Z Last Updated: 2024-09-26T19:58:14.787Z Vendors: Jenkins Project Products: Jenkins Job Configuration History Plugin Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235 - http://www.openwall.com/lists/oss-secu
eferences: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41933 State: PUBLISHED Published: 2023-09-06T12:08:54.329Z Last Updated: 2024-09-26T19:57:44.018Z Vendors: Jenkins Project Products: Jenkins Job Configuration History Plugin Description: Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41934 State: PUBLISHED Published: 2023-09-06T12:08:55.028Z Last Updated: 2024-09-26T19:57:19.685Z Vendors: Jenkins Project Products: Jenkins Pipeline Maven Integration Plugin Description: Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3257 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41935 State: PUBLISHED Published: 2023-09-06T12:08:55.693Z Last Updated: 2024-09-26T19:55:15.254Z Vendors: Jenkins Project Products: Jenkins Azure AD Plugin Description: Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41936 State: PUBLISHED Published: 2023-09-06T12:08:56.365Z Last Updated: 2024-09-26T19:54:41.046Z Vendors: Jenkins Project Products: Jenkins Google Login Plugin Description: Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3228 - http://www.openwall.com/lists/oss-security/2023/09/06/9
CVE ID: CVE-2023-41937 State: PUBLISHED Published: 2023-09-06T12:08:57.044Z Last Updated: 2024-09-26T19:53:52.607Z Vendors: Jenkins Project Products: Jenkins Bitbucket Push and Pull Request Plugin Description: Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3165 -