David Fiser

يحتوي البرنامج على ثغرة أمنية تسمح بتجاوز المصادقة، ناتجة عن تخصيص أذونات غير صحيحة في رمز حساب التخزين. وهذا يسمح للمهاجمين عن بُعد بتجاوز المصادقة دون الحاجة إلى تسجيل الدخول. تتيح هذه الثغرة للمهاجمين الوصول إلى النظام من خلال استغلال الأذونات المرتبطة بالرمز. تشير عدة تقارير إلى احتمال وجود مخاطر في سلسلة التوريد، بما في ذلك القدرة على استبدال نماذج الذكاء الاصطناعي. لم يتم الإبلاغ عن أرقام تقديرية للأجهزة المتأثرة أو الحوادث الفعلية بخلاف اكتشاف الثغرة.

يحتوي البرنامج على ثغرة في عملية المصادقة بسبب التخصيص الخاطئ لأذونات رموز SAS. وهذا يسمح بالوصول غير المصرح به.

اسم البرنامج المعرض للثغرة والإصدارات المتأثرة: NVIDIA Riva (الإصدارات المتأثرة غير محددة) الوصف: تتعلق المشكلة بعدم كفاية ضوابط الوصول، مما قد يُستغل للتلاعب بالبيانات أو التسبب في رفض الخدمة. التوصيات: حتى الآن، لا توجد معلومات عن إصدار أحدث يتضمن تصحيحًا لهذه الثغرة الأمنية.

تتعلق المشكلة بوجود خلل في التحكم في الوصول، مما قد يؤدي إلى تصعيد الامتيازات، أو التلاعب بالبيانات، أو رفض الخدمة، أو الكشف عن المعلومات. وقد يؤدي الاستغلال الناجح لهذه الثغرة الأمنية إلى عواقب وخيمة. لم يتم تحديد العدد التقديري للأجهزة التي قد تكون متأثرة على مستوى العالم. هناك تقارير عن حوادث فعلية تم فيها استغلال هذه المشكلة.

The issue is related to the Azure Service Fabric Container and involves an elevation of privilege vulnerability. This vulnerability is associated with the WAagent daemon and its insecure management of privileges. Exploitation of this issue could allow an attacker to elevate their privileges.

The issue allows stored credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials could be viewed by users with Extended Read permission or access to the master file system.

The issue concerns the storage of credentials in an unencrypted manner within the global configuration file and job config.xml files on the Jenkins master. This allows users with Extended Read permission or access to the master file system to view these credentials.

The issue concerns the storage of sensitive information by the Jenkins Sofy.AI Plugin. Specifically, it stores credentials and an API token unencrypted in job config.xml files on the Jenkins master or controller. This unencrypted storage allows users with Extended Read permission or access to the master or controller file system to view these sensitive details. There is no information provided about the estimated number of potentially affected devices or real-world incidents related to this issue.

The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master. Users with Extended Read permission or access to the master file system can view these credentials.

The issue concerns the storage of credentials in an unencrypted manner within job config.xml files on the Jenkins master or controller. These credentials can be accessed by users who have Extended Read permission or those with direct access to the master or controller file system.

The issue concerns the storage of credentials in an unencrypted manner within the global config.xml configuration file on the Jenkins master. This allows users with access to the master file system to view these credentials.

The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the credentials are stored in the `com.soasta.jenkins.CloudTestServer.xml` file. This could allow users with access to the Jenkins controller file system to view these credentials. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins View26 Test-Reporting Plugin stores credentials and an access token unencrypted in job config.xml files on the Jenkins master or controller. This allows users with Extended Read permission or access to the master or controller file system to view these sensitive details.

The issue concerns the storage of credentials in an unencrypted manner within the global configuration file of the Jenkins master. This allows users with access to the master file system to view these credentials.

The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. These credentials can be accessed by users with Extended Read permission or those who have access to the master file system.

The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master. This allows users with access to the master file system to view these credentials.

The issue concerns the storage of credentials in an unencrypted manner within the global configuration file on the Jenkins master or controller. Specifically, the credentials are stored in the hudson.plugins.testlink.TestLinkBuilder.xml file. This allows users with access to the Jenkins controller or master file system to view these credentials. There is no information available about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue allows credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission or those who have access to the master file system.

A stored cross-site scripting issue allows attackers who can edit descriptions and other fields to insert links with the `javascript:` scheme into the Jenkins UI. The PegDown Formatter Plugin uses the PegDown library to render Markdown formatted descriptions and advertises disabling of HTML to prevent cross-site scripting, but it does not prevent the use of the `javascript:` scheme in URLs for links. This results in an exploitable issue by users able to configure entities with descriptions that are rendered by the configured markup formatter.

The issue allows attackers who can configure jobs in Jenkins to read the contents of any file on the Jenkins master. This is due to an arbitrary file read vulnerability.