193 matches found
GHSA-42M6-7XFF-9V9M Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins before versions 2.44 and 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes SECURITY-382. Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins...
Woodpecker allows cross-site scripting (XSS) via build logs
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
GHSA-VMP5-C5HP-6C65 Woodpecker allows cross-site scripting (XSS) via build logs
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
Cross site scripting
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
CVE-2022-29947 affects Woodpecker (Woodpecker CI) prior to version 0.15.1. Root cause: missing escaping in web/src/components/repo/build/BuildLog.vue enables cross-site scripting via build logs. Impact: XSS in the client when rendering build logs. Mitigation: upgrade to Woodpecker v0.15.1 (as doc...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
PT-2022-19928 · Unknown · Woodpecker
Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 0.15.1 Description: The issue allows cross-site scripting XSS via build logs because the BuildLog.vue component in web/src/components/repo/build lacks proper escaping. This can lead to the execution of malicious...
CVE-2022-23109
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...
CVE-2020-2312
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
Default credentials
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
CVE-2020-2312
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
PT-2020-15542 · Jenkins · Jenkins Sqlplus Script Runner Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins SQLPlus Script Runner Plugin versions 2.0.12 and earlier Description: The issue concerns the Jenkins SQLPlus Script Runner Plugin, where a password provided as a command line argument is not masked in build logs. This allows users wit...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
Design/Logic Flaw
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
CVE-2020-15829
CVE-2020-15829 affects JetBrains TeamCity prior to 2019.2.3, where password parameters could be disclosed via build logs. The issue is documented in multiple sources (NVD/NVD-reported; Red Hat and CVE listings) and appears under the TeamCity component in JetBrains’ Q2 2020 security bulletin (TW-6...