GHSA-JQWH-JRPG-5J3H Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification...

Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

GHSA-PWRM-8MVM-P2F2 Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into...

GHSA-W8GX-HHCX-PX6W Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

Infinispan Rest API Does Not Enforce Auth Constraints

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name...

GHSA-QXH5-5R5P-5GVF Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API. The vulnerability is found in: - blueocean-core-js/src/js/bundleStartup.js - blueocean-core-js/src/js/fetch.ts -...

Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API. The vulnerability is found in: - blueocean-core-js/src/js/bundleStartup.js - blueocean-core-js/src/js/fetch.ts -...

GHSA-8CRR-XF35-5F5P Jenkins Job Import Plugin CSRF vulnerability

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration...

Jenkins Job Import Plugin CSRF vulnerability

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration...

GHSA-VHH3-MVC4-HHQ6 Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data...

Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration

A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent...

GHSA-8HXM-42V5-66HM Moodle vulnerable to Cross-Site Request Forgery

Multiple cross-site request forgery CSRF vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data...

The vulnerability of the Libraries component of the Oracle GraalVM Enterprise Edition virtual machine allows a hacker to modify data.

The vulnerability of the Libraries component in the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to modify, add, or delete data using network packet...

The vulnerability of the RDBMS Gateway/Generic ODBC Connectivity component of the Oracle Database Server allows a hacker to gain access to read data or to modify, add, or delete data.

The vulnerability of the RDBMS Gateway/Generic ODBC Connectivity component of the Oracle Database Server exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to gain read access to data, or to modify, add, or delete data using network packe...

The vulnerability of the Java VM component of the Oracle Database Server management system allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the Java VM component of the Oracle Database Server management system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely gain access to modify, add, or delete data through various network protocols...

The vulnerability of the InnoDB component of the MySQL Database Server allows a hacker to gain access to modify, add, or delete data, or to cause the system to crash.

The vulnerability of the InnoDB component of the MySQL Database Server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to modify, add, or delete data, or to cause the system to terminate abnormally via network packets...

Vulnerability of the MySQL Server component: The Optimizer component of the MySQL database management system allows a hacker to gain unauthorized access to modify, add, or delete data, or to cause service failures.

The vulnerability of the MySQL Server component involves insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to modify, add, or delete data, or to cause a service failure using the MySQL network protocol...

Vulnerability of the MySQL Server component: The Optimizer component of the MySQL database management system allows a hacker to gain unauthorized access to modify, add, or delete data, or to cause service failures.

The vulnerability of the MySQL Server component involves insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to modify, add, or delete data, or to cause a service failure using the MySQL network protocol...

Vulnerability of the MySQL Server component: The Optimizer component of the MySQL database management system allows a hacker to gain unauthorized access to modify, add, or delete data, or to cause service failures.

The vulnerability of the MySQL Server component involves insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to modify, add, or delete data, or to cause a service failure using the MySQL network protocol...