Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.

CVE-2023-43374

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.

CVE-2023-43371

phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-controlled data is directly passed to the PHP 'unserialize()' function in multiple places. An example is the functionality to manage tables in 'tables.php' where the 'ma[]' POST parameter is deserialized.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-40619: vulnerability-research/CVE-2023-40619 at main · dub-flow/vulnerability-research

An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.

CVE-2023-39044: CVE-reports/CVE-2023-39044.md at main · syz913/CVE-reports

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Build Failure Analyzer Plugin

**Descriptions****Builds can be filtered by values of sensitive build variables**

**SECURITY-3261 / CVE-2023-43494**  
**Severity (CVSS):** Medium  
**Description:**

Jenkins allows filtering builds in the build history widget by specifying an expression that searches for matching builds by name, description, parameter values, etc.

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from this search.

This allows attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

Jenkins 2.424, LTS 2.414.2 excludes sensitive variables from this search.

**Stored XSS vulnerability**

**SECURITY-3245 / CVE-2023-43495**  
**Severity (CVSS):** High  
**Description:**

ExpandableDetailsNote allows annotating build log content with additional information that can be revealed when interacted with.

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the caption constructor parameter of ExpandableDetailsNote.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide caption parameter values.

As of publication, the related API is not used within Jenkins (core), and the Jenkins security team is not aware of any affected plugins.

Jenkins 2.424, LTS 2.414.2 escapes caption constructor parameter values.

**Temporary plugin file created with insecure permissions**

**SECURITY-3072 / CVE-2023-43496**  
**Severity (CVSS):** High  
**Description:**

Jenkins creates a temporary file when a plugin is deployed directly from a URL.

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.

This issue complements SECURITY-2823, which affected plugins uploaded from an administrator’s computer.

Jenkins 2.424, LTS 2.414.2 creates the temporary file in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.

**Temporary uploaded file created with insecure permissions**

**SECURITY-3073 / CVE-2023-43497 (Stapler), CVE-2023-43498 (MultipartFormDataParser)**  
**Severity (CVSS):** Low  
**Description:**

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API MultipartFormDataParser create temporary files in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.

Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.

**Stored XSS vulnerability in Build Failure Analyzer Plugin**

**SECURITY-3244 / CVE-2023-43499**  
**Severity (CVSS):** High  
**Affected plugin: build-failure-analyzer**  
**Description:**

Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

Build Failure Analyzer Plugin 2.4.2 escapes Failure Cause names in build logs.

**CSRF vulnerability and missing permission check in Build Failure Analyzer Plugin allow SSRF**

**SECURITY-3226 / CVE-2023-43500 (CSRF), CVE-2023-43501 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: build-failure-analyzer**  
**Description:**

Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Build Failure Analyzer Plugin 2.4.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.

**CSRF vulnerability in Build Failure Analyzer Plugin allows deleting Failure Causes**

**SECURITY-3239 / CVE-2023-43502**  
**Severity (CVSS):** Medium  
**Affected plugin: build-failure-analyzer**  
**Description:**

Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST requests for an HTTP endpoint, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to delete Failure Causes.

Build Failure Analyzer Plugin 2.4.2 requires POST requests for the affected HTTP endpoint.

**Severity**

*   SECURITY-3072: High
*   SECURITY-3073: Low
*   SECURITY-3226: Medium
*   SECURITY-3239: Medium
*   SECURITY-3244: High
*   SECURITY-3245: High
*   SECURITY-3261: Medium

**Affected Versions**

*   **Jenkins weekly** up to and including 2.423
*   **Jenkins LTS** up to and including 2.414.1
*   **Build Failure Analyzer Plugin** up to and including 2.4.1

**Fix**

*   **Jenkins weekly** should be updated to version 2.424
*   **Jenkins LTS** should be updated to version 2.414.2
*   **Build Failure Analyzer Plugin** should be updated to version 2.4.2

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Andrea Chiera, CloudBees, Inc.** for SECURITY-3226, SECURITY-3239
*   **Daniel Beck, CloudBees, Inc.** for SECURITY-3072, SECURITY-3073
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-3244, SECURITY-3245
*   **sunita** for SECURITY-3261

CVE-2023-43502: Jenkins Security Advisory 2023-09-20

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

CVE-2023-43496: Jenkins Security Advisory 2023-09-20

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

CVE-2023-43494: Jenkins Security Advisory 2023-09-20

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

CVE-2023-43500: Jenkins Security Advisory 2023-09-20

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.

CVE-2023-43495: Jenkins Security Advisory 2023-09-20

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

Source

CVE