CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10415

CVE-2019-10415 affects Jenkins Violation Comments to GitLab Plugin, version 2.28 and earlier. The root issue is that API tokens/credentials were stored unencrypted in the plugin’s global configuration file on the Jenkins master, enabling viewing by users with access to the master filesystem. Impa...

CVE-2019-10416

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2019-10415

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10416

Summary: CVE-2019-10416 affects the Jenkins Violation Comments to GitLab Plugin (version 2.28 and earlier). The underlying issue is storage of credentials in plaintext within job config.xml files on the Jenkins master, exposing tokens to users with Extended Read permission or anyone with access t...

PT-2019-14847

Name of the Vulnerable Software and Affected Versions Halo version 1.1.0 Description The issue allows for XSS via a crafted authorUrl in JSON data to the "api/content/posts/comments" API endpoint. Recommendations For Halo version 1.1.0, avoid using the authorUrl variable in the...

XSS Vulnerability in anyoucms Frontend User Messages

anyoucms is a website building system. An XSS vulnerability exists in anyoucms front-end user comments, which can be exploited by attackers to execute script code...

CVE-2019-16890: Improper Neutralization of Input During Web Page Generation

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...

CVE-2019-10415: Insufficiently Protected Credentials

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10416: Insufficiently Protected Credentials

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

WordPress 3.8.x < 3.8.30 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...

WordPress 5.0.x < 5.0.6 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...

WordPress spotim-comments plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. spotim-comments is a user interaction plugin used in it, which includes features such as real-time comments, online chat, and...

CVE-2019-15734

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

CVE-2019-15731

CVE-2019-15731 affects GitLab Community and Enterprise Edition 12.0–12.2.1. The issue allows non-members to comment on merge requests even when the repository is configured to permit comments only from project members. Root cause details are not explicitly provided in the connected documents beyo...

Atlassian Jira WikiRenderer parser XSS vulnerability

Summary An exploitable XSS vulnerability exists in the WikiRenderer functionality of Atlassian Jira, from version 7.6.4 to 8.1.0. A specially crafted comment can cause a persistent XSS. An attacker can create a comment or worklog entry to trigger this vulnerability. Tested Versions Atlassian Jira...

CVE-2019-15734: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

PT-2019-14356

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.6 through 12.2.1 Description An issue was discovered where commit titles and team member comments could become viewable to users who did not have permission to access these under very specific...