CVE-2021-24527

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such...

Form Builder 1.9.8.4 - Reflected Cross-Site Scripting (XSS)

The plugin does not properly sanitise and escape its fromid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue. PoC The formid digits before the payload must be valid: https://example.com/wp-admin/admin.php?page=smuz-formsid=1242;alert/XSS/...

Debian DSA-4949-1 : jetty9 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4949 advisory. - In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a speciall...

CVE-2021-24461

The getfaqs function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2020-35945: Unrestricted Upload of File with Dangerous Type

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...

PT-2020-16936

Name of the Vulnerable Software and Affected Versions td-agent-builder plugin for Fluentd versions prior to 2020-12-18 Description The issue allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITYSYSTEM...

CVE-2020-10196

CVE-2020-10196 affects the WordPress plugin Popup Builder (versions before 3.64.1). A stored XSS flaw exists in an unsecured AJAX action (com/classes/Ajax.php) where an unauthenticated attacker can POST to wp-admin/admin-ajax.php with action sgpb_autosave and an allPopupData payload (including th...

WordPress Popup Builder Plugin 2.2.8 < 3.0 SQL Injection Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2020-2125

Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...

CVE-2020-2125

The CVE-2020-2125 issue affects Jenkins Debian Package Builder Plugin versions 1.6.11 and earlier. The vulnerability is that the plugin stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master/controller, specifically ru.yandex.jenkins.plugins.debuilder.DebianPac...

CVE-2020-2125: Insufficiently Protected Credentials

Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...

WordPress nex-forms-express-wp-form-builde plugin SQL injection vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. nex-forms-express-wp-form-builder is a form builder plugin used in it. A SQL injection vulnerability exists in the...

CVE-2019-10398

Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10398

Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10398

Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10398

The CVE-2019-10398 entry concerns Jenkins Beaker Builder Plugin (versions ≤ 1.9). The vulnerability arises from credentials being stored unencrypted in the plugin’s global configuration file on the Jenkins master, enabling users with file-system access to view them. Impact is credential disclosur...

PT-2019-11792 · Jenkins · Jenkins Beaker Builder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Beaker Builder Plugin versions 1.9 and earlier Description: The issue concerns the storage of credentials in the Jenkins Beaker Builder Plugin. Specifically, the plugin stored credentials unencrypted in its global configuration file o...

CVE-2019-10398: Insufficiently Protected Credentials

Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

WordPress profile-builder plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress profile-builder plugin. An attacker can exploit...