High · CVSS 8.8
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
Published Sep 20, 2022 · Updated May 28, 2025
Critical · CVSS 9.8
A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. A remote user may be able to cause kernel code execution.
Published Sep 20, 2022 · Updated May 28, 2025
High · CVSS 8.8
This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
Published Sep 20, 2022 · Updated May 28, 2025
High · CVSS 7.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted file may lead to arbitrary code execution.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 6.5
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
Published Sep 20, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 7
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
Published Sep 21, 2022 · Updated May 28, 2025
Low · CVSS 3.7
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 7.5
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.5
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.
Published Sep 20, 2022 · Updated May 28, 2025
High · CVSS 7.5
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 7.5
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 4.4
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.3
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 6.8
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.
Published Sep 21, 2022 · Updated May 28, 2025
Critical · CVSS 9.8
Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 4.3
Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.3
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the .../report URL with a report based on attacker-specified report generation options.
Published Sep 21, 2022 · Updated May 28, 2025
Critical · CVSS 9.8
Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.
Published Sep 21, 2022 · Updated May 28, 2025
Critical · CVSS 9.8
Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 4.3
Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain names and URLs of Jenkins servers that the plugin is configured to publish builds to, as well as builds pending for publication to those Jenkins servers.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.7
Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system by providing a crafted file name to an API endpoint.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8
A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.4
A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.1
Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.1
Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 4.3
A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 4.3
Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 6.5
Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 6.5
Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 6.5
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 7.2
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
Published Sep 21, 2022 · Updated May 28, 2025
High · CVSS 8
The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 5.4.1 and below.
Published Sep 21, 2022 · Updated May 28, 2025
Medium · CVSS 5.3
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.
Published Sep 21, 2022 · Updated May 28, 2025
