Allele Security Intelligence

ASA-2019-00604 – Jenkins Deploy WebLogic Plugin: Cross-Site Request Forgery

Posted on November 4, 2019November 4, 2019 by Allele Security Intelligence in Alerts

The form validation method does not require POST requests, resulting in a CSRF vulnerability.

ASA-2019-00602 – Jenkins Dynatrace Application Monitoring Plugin: Cross-Site Request Forgery

Posted on November 4, 2019November 4, 2019 by Allele Security Intelligence in Alerts

Dynatrace Application Monitoring Plugin did not require POST requests on a method implementing form validation. This CSRF vulnerability allowed attackers to initiate a connection test to an attacker-specified server with attacker-specified username and password.

ASA-2019-00473 – Mikrotik RouterOS: Memory exhaustion via a crafted POST request

Posted on July 26, 2019November 30, 2020 by Allele Security Intelligence in Alerts

This vulnerability is similar to the CVE-2018-1157. An authenticated user can cause the www binary to consume all memory via a crafted POST request to /jsproxy/upload. It's because of the incomplete fix for the CVE-2018-1157.