CVE-2022-30429: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...

Authentication Bypass Vulnerability in Multiple VMware Products

VMware vRealize Automation is a management tool that provides self-service, supervisory multi-cloud automation.VMware Workspace One Access is a centralized management console through which you can manage users and groups, set and manage authentication and access policies, and add resources to the...

How to Add process Management black/White list on WEM

...

PT-2022-28256

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue concerns the notification module, which fails to properly escape HTML from the server, leading to potential XSS vulnerabilities. This could affect various entity names and label...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2019-10406 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2019-10403 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...

Exploit for CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspa...

XXE vulnerability in Jenkins Performance Plugin

Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins...

GHSA-MJ5V-GGJC-48P5 XXE vulnerability in Jenkins OWASP Dependency-Check Plugin

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the...

GHSA-HR8P-76Q8-FXWQ XXE vulnerability in Jenkins Performance Plugin

Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins...

XXE vulnerability in Jenkins OWASP Dependency-Check Plugin

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2021-21698 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2021-21698 Source...

GHSA-P674-HH8X-RV5H XML external entity vulnerability in Jenkins Nuget Plugin

Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This XML parser is used for the "Build on NuGet updates" feature. This allows attackers with the ability to control the contents of the packages.config file in a workspace to have...

XML external entity vulnerability in Jenkins Nuget Plugin

Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This XML parser is used for the "Build on NuGet updates" feature. This allows attackers with the ability to control the contents of the packages.config file in a workspace to have...

Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

GHSA-7J3X-XM4J-JFJ7 Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

GHSA-QXP6-27GW-99CJ Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins

Due to a time-of-check to time-of-use TOCTOU race condition, the file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2. This allows attackers with Job/Workspace...

Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins

Due to a time-of-check to time-of-use TOCTOU race condition, the file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2. This allows attackers with Job/Workspace...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2021-21611 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...