CVE-2022-27205: Missing Authorization

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Jenkins Plugin Extended Choice Parameter: Path traversal vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Extended Choice Parameter Plugin...

Jenkins Extended Choice Parameter Plugin: Permissions and access control issues

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Extended Choice Parameter Plugin is vulnerable to a permission...

Jenkins Extended Choice Parameter Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both products of Jenkins. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from the plugin's failure to escape the value and description ...

CVE-2022-27204: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers to connect to an attacker-specified URL...

PT-2022-18290 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: The issue allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

PT-2022-18289 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the plugin does not escape the value and description of...

CVE-2022-27203: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

CVE-2022-27202: Improper Neutralization of Input During Web Page Generation

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-18291 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: A cross-site request forgery vulnerability allows attackers to connect to an attacker-specified URL. The issue arises because the plugin does not...

Senate Committee passes new antitrust bill aimed at Big Tech companies

The American Innovation and Choice Online Act AICOA, a bill that forbids Big Tech platforms like Apple, Alphabet Google’s parent company, and Amazon from generally behaving in an anti-competitive manner, was approved by the Senate Judiciary Committee late last week with a 16-6 vote. US Senator Am...

Owner should be able to choose to not ignore failures in updateYieldStrategy

Handle harleythedog Vulnerability details Impact In Sherlock.sol, the function updateYieldStrategy ignores all errors when yieldStrategy.withdrawAll is called, and I believe this is an dangerous design choice. If yieldStrategy.withdrawAll reverts, then all the funds that are deposited in the yiel...

org.biouno:uno-choice (>=1.0, <=1.4) potentially affected by CVE-2021-21667 via org.jenkins-ci.plugins:scriptler (2.7)

org.jenkins-ci.plugins:scriptler MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:scriptler and may be impacted: - org.biouno:uno-choice =1.0, =1.4 Source cves: CVE-2021-21667 Source advisory:...

org.biouno:uno-choice (>=1.5-alpha-1, <=1.5.3) potentially affected by CVE-2021-21667 via org.jenkins-ci.plugins:scriptler (2.9)

org.jenkins-ci.plugins:scriptler MAVEN version 2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:scriptler and may be impacted: - org.biouno:uno-choice =1.5-alpha-1, =1.5.3 Source cves: CVE-2021-21667 Source advisory:...

org.biouno:uno-choice (>=1.0, <=1.4) potentially affected by CVE-2021-21668 via org.jenkins-ci.plugins:scriptler (2.7)

org.jenkins-ci.plugins:scriptler MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:scriptler and may be impacted: - org.biouno:uno-choice =1.0, =1.4 Source cves: CVE-2021-21668 Source advisory:...

org.biouno:uno-choice (>=1.5-alpha-1, <=1.5.3) potentially affected by CVE-2021-21668 via org.jenkins-ci.plugins:scriptler (2.9)

org.jenkins-ci.plugins:scriptler MAVEN version 2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:scriptler and may be impacted: - org.biouno:uno-choice =1.5-alpha-1, =1.5.3 Source cves: CVE-2021-21668 Source advisory:...

com.seitenbau.jenkins.plugins:dynamicparameter (0.2.0), org.biouno:uno-choice (>=1.0, <=1.5.3) potentially affected by CVE-2021-21700 via org.jenkins-ci.plugins:scriptler (>=2.2, <=2.9)

org.jenkins-ci.plugins:scriptler MAVEN version =2.2, =1.0, =1.5.3 Source cves: CVE-2021-21700 Source advisory: MEND:CVE-2021-21700...

Stored XSS vulnerability in uno-choice

uno-choice 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. uno-choice 2.5.7 escapes references to parameter names...

WordPress Wp Cookie Choice Cross-site Request Forgery Vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language, a WordPress open source application plugin that supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Wp Cookie Choice 1.1.0 and earlier versions are vulnerable to...

CVE-2021-24595

The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack...