2964 matches found
CVE-2021-21630
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2021-21630
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2021-21630
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
CVE-2021-21630
CVE-2021-21630 concerns the Jenkins Extra Columns Plugin. Versions up to and including 1.22 do not escape parameter values in the build parameters column, causing a stored XSS vulnerability exploitable by attackers with Job/Configure permission. Jenkins Plugin 1.23 and later fix the issue by esca...
PT-2021-14673 · Jenkins · Jenkins Extra Columns Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Extra Columns Plugin versions 1.22 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability due to the plugin not escaping parameter values in the build parameters column. This vulnerability is...
Jenkins Extra Columns 跨站脚本漏洞
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...
CVE-2021-21630: Improper Neutralization of Input During Web Page Generation
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
Stored XSS vulnerability in extra-columns
extra-columns 1.22 and earlier does not escape parameter values in the build parameters column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build...
Moneybird: Access control issue on invoice documents downloading feature.
Reporter has found a way to download exports as an unauthorized user. This was only possible after changing the permissions for the user and having a certain page open during this change. The issue has been resolved by adding extra permission checks during the download action...
CVE-2021-3424
A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...
CVE-2021-0305
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9...
DRUPAL-CONTRIB-2021-001
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter. The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information ...
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-001
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter. The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information ...
PT-2021-30997
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter. The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information ...
Design/Logic Flaw
The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...
Design/Logic Flaw
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...
CVE-2020-35945
The Divi Builder plugin, Divi theme, and Divi Extra theme for WordPress are vulnerable to an authenticated arbitrary file upload before version 4.5.3 . The root cause is that file extension checks are performed exclusively on the client side, allowing attackers with contributor-level privileges o...
PT-2021-11877
Name of the Vulnerable Software and Affected Versions: Divi Builder plugin versions prior to 4.5.3 Divi theme versions prior to 4.5.3 Divi Extra theme versions prior to 4.5.3 Description: An issue allows authenticated attackers with contributor-level or above capabilities to upload arbitrary file...
CVE-2020-35945: Unrestricted Upload of File with Dangerous Type
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the...
UBUNTU-CVE-2020-25628
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...