CVE-2022-27196

The CVE-2022-27196 entry concerns Jenkins Favorite Plugin (versions up to 2.4.0 and earlier). The vulnerability arises because the plugin does not escape job names in the favorite column, causing stored XSS. This is exploitable by attackers with Item/Configure or Item/Create permissions. Connecte...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

PT-2022-18282 · Jenkins · Jenkins Favorite Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Favorite Plugin versions 2.4.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the names of jobs in the favorite column are not properly escaped. Attackers with...

Jenkins Favorite Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Configure or Item/Create privileges could be exploited to cause a stored cross-site...

CVE-2022-27196: Improper Neutralization of Input During Web Page Generation

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

Stored XSS vulnerability in favorite

favorite 2.4.0 and earlier does not escape the names of jobs in the favorite column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. favorite 2.4.1 escapes the names of jobs in the favorite column...

Cross-site Scripting (XSS) - Stored in pimcore/web2print-tools

Description Stored XSS in the Description of the Favorite Output Channel Configurations. Steps to reproduce 1.Go to https://demo.pimcore.fun/admin/ and login. 2.In the left menu bar, click the Settings icon then choose Favorite Output Channel Configurations, the Favorite Output Channel...

CVE-2021-28901

Multiple cross-site scripting XSS vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to inject arbitrary web script or HTML via the 1 NOMCLI , 2 ADRESSE , 3 ADRESSE2, 4 LOCALITE parameters to /eshop/products/json/aouCustomerAdresse; and the 5 nomlis...

Cross-Site Request Forgery (CSRF) in myvesta/vesta

✍️ Description Attacker is able to "delete" an element from favorite. this vulnerability happens on some sections. for example on “Firewall” tab list/firewall/ 🕵️‍♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally first record deletes from...

IoT Device Takeovers Surge 100 Percent in 2020

Connected cameras, refrigerators and other seemingly-mundane internet-of-things IoT devices are a cybercriminal favorite this year, with new research showing a sharp increase 100 percent in IoT infections observed on wireless networks. IoT devices are now responsible for 32.72 percent of all...

CVE-2020-15711

In MISP before 2.4.129, setting a favourite homepage was not CSRF protected...

PT-2019-13934

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.8.0 Description The issue concerns an improper authorization vulnerability in the /json/profile/removeStarAjax.do resource. This allows remote attackers to remove another user's favourite...

CVE-2019-3576

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...

Did my comment on your blog get lost?

If you ever feel bad about your job because of mindless tasks you must perform day after day, or if you're bothered by the fact that your chosen work pays crap, produces nothing useful, and helps no one: have a look at blog comment spammers and breathe a sigh of relief. They make almost any job...

CVE-2017-1000244

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification...

CVE-2017-1000243

Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites...

CVE-2017-16567

Persistent Cross-Site Scripting XSS vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality...

Cross site scripting

Cross-site scripting XSS vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a "favorite."...

Logitech Media Server Cross-Site Scripting Vulnerability (CNVD-2017-36361)

Logitech Media Server is an audio playback software from Logitech USA. A cross-site scripting vulnerability exists in Logitech Media Server version 7.9.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the 'favorite' tag...

PT-2017-14451 · Logitech · Logitech Media Server

Name of the Vulnerable Software and Affected Versions: Logitech Media Server version 7.9.0 Description: The issue is related to a Cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a favorite. This vulnerability can lead to Session...