CVE-2023-0422

The Article Directory WordPress plugin through 1.3 does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts...

CVE-2023-0422 Article Directory <= 1.3 - Admin+ Stored XSS

The Article Directory WordPress plugin through 1.3 does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts...

Article Directory <= 1.3 - Admin+ Stored XSS

The plugin does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts. PoC POST /wordpress/wp-admin/options.php HTTP/1.1 Host: 172.28.128.6 User-Agent: Mozilla/5.0...

CVE-2023-0278

The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-2046 Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite...

CVE-2022-2072

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

The plugin allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations. 1. Craft a custom zip file...

Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

The plugin allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations. PoC 1. Craft a custom zip...

Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them. PoC As admin, Import the following CSV...

WordPress Name Directory plugin <= 1.25.3 - Arbitrary Directory/Name Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Directory/Name Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in the WordPress Name Directory plugin versions = 1.25.3. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.4...

Improper Authentication in Jenkins Active Directory Plugin

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. The LDAP-based mode in Active Directory Plugin starting in version 1.44 and prior to versions 2.16.1 and 2.20 shares code between user lookup and user authenticatio...

GHSA-RF92-3VJR-W628 Improper Authentication in Jenkins Active Directory Plugin

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. The LDAP-based mode in Active Directory Plugin starting in version 1.44 and prior to versions 2.16.1 and 2.20 shares code between user lookup and user authenticatio...

Authentication cache in Active Directory Jenkins Plugin allows logging in with any password

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications. In Active Directory Plugin prior to 2.20 and 2.16.1,...

Jenkins Active Directory Plugin Improper certificate validation with StartTLS

An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...

CVE-2022-23105

CVE-2022-23105 affects Jenkins Active Directory Plugin 2.25 and earlier. The vulnerability stems from the plugin not encrypting data transmitted between the Jenkins controller and Active Directory servers in most configurations, enabling potential information disclosure. Connected advisories refe...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . An information disclosure vulnerability exists in Jenkins Active Directory Plugin version 2.25 and earlier, which stems...

CVE-2022-23105: Cleartext Transmission of Sensitive Information

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

PT-2022-15847 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.25 and earlier Description: The issue concerns the transmission of data between the Jenkins controller and Active Directory servers, which is not encrypted in most configurations. Recommendations: Fo...

WordPress plugin uListing permission elevation vulnerability

WordPress plugin uListing is a directory and listing plugin based on Vue.js. WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to an elevation of privilege vulnerability. No details of the vulnerability are currently available...