208 matches found
PYSEC-2022-43182
Withdrawn as duplicate of PYSEC-2022-239. The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...
fava 跨站脚本漏洞
fava is the web interface of Beancount, an open source double-entry bookkeeping software from Beancount. A cross-site scripting vulnerability exists in versions prior to fava v1.22, which stems from the time and filter parameters being vulnerable to reflective cross-site scripting...
Softing Secure Integration Server 安全漏洞
Softing Secure Integration Server is a secure integration server from Softing Germany. It provides a powerful OPC UA data integration layer and supports interface abstraction, aggregation, data preprocessing and security supervision. A security vulnerability exists in Softing Secure Integration...
GHSA-WX66-PM7R-2Q82 Stored XSS vulnerability in Jenkins Extra Columns Plugin
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured...
CVE-2022-29042
CVE-2022-29042 – Jenkins Job Generator Plugin : The Jira Job Generator Plugin (and related Red Hat, CNVD, osv, and other feeds) documents indicate that versions 1.22 and earlier of the Jenkins Job Generator Plugin do not escape the name and description of Generator Parameter and Generator Choice ...
PT-2022-15856 · Jenkins · Jenkins Publish Over Ssh Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: The issue allows attackers with Item/Configure permission to discover the name of the Jenkins controller files due to a path traversal vulnerability. This occurs because t...
PT-2022-15854 · Jenkins · Jenkins Publish Over Ssh Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials. Recommendations: For Jenkins...
Jenkins Plugin 跨站请求伪造漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Publish Over SSH Plugin in version 1.22 and earlier contains a cross-site request forgery vulnerability that stems...
Jenkins Plugin 跨站脚本漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Publish Over SSH Plugin in version 1.22 and earlier has a cross-site scripting vulnerability that stems from the...
PT-2022-15853 · Jenkins · Jenkins Publish Over Ssh Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over SSH Plugin versions 1.22 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the SSH server name is not properly escaped, allowing attackers with...
HP Edgeline Infrastructure Management 访问控制错误漏洞
HPE Edgeline Infrastructure Management is a software from Hewlett-Packard HPE for data center environments to manage Edge devices. An authorization issue vulnerability exists in Edgeline Infrastructure Manager versions prior to 1.22 that stems from a failure to perform adequate authorization...
PT-2021-14673 · Jenkins · Jenkins Extra Columns Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Extra Columns Plugin versions 1.22 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability due to the plugin not escaping parameter values in the build parameters column. This vulnerability is...
jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...
jenkins-credentials-binding-plugin: improper masking of secrets
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...
jenkins-credentials-binding-plugin: improper masking of secrets
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...
PT-2020-15394 · Jenkins · Jenkins Credentials Binding Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Credentials Binding Plugin versions 1.22 and earlier Description: The issue concerns the Jenkins Credentials Binding Plugin, where secrets are not masked in the build log when the build contains no build steps. This affects the securi...
stb heap buffer overflow vulnerability
stb is a C/C++ library consisting of a single file. A heap buffer overflow vulnerability exists in stbttbufpeek8 in stbtruetype.h in stb 1.22 and earlier versions. An attacker can exploit this vulnerability to cause a buffer overflow or heap overflow, among other things...
stb heap buffer overflow vulnerability (CNVD-2020-04059)
stb is a C/C++ library consisting of a single file. A heap buffer overflow vulnerability exists in stbttbufget8 in stbtruetype.h in stb 1.22 and earlier versions. An attacker can exploit this vulnerability to cause a buffer overflow or heap overflow, among other things...
stb assertion failure vulnerability (CNVD-2020-04055)
stb is a C/C++ library consisting of a single file. An assertion failure vulnerability exists in stbttcffint in stbtruetype.h in stb 1.22 and earlier. An attacker can exploit this vulnerability to cause a denial of service...