130 matches found
CVE-2020-2175
Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by users able to control the XML input files processed by the plugin...
PT-2020-15388 · Jenkins · Jenkins Fitnesse Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins FitNesse Plugin versions 1.31 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not correctly escape report contents before showing them on the Jenkins...
CVE-2020-2175: Improper Neutralization of Input During Web Page Generation
Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by users able to control the XML input files processed by the plugin...
Stored XSS vulnerability in fitnesse
fitnesse 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI. This results in a stored cross-site scripting XSS vulnerability exploitable by users able to control the XML input files processed by the plugin. fitnesse 1.33 escapes content from XML input...
CloudBees Jenkins FitNesse plugin code issue vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A code issue vulnerability...
CVE-2020-2120
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
CVE-2020-2120
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
Xxe
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
CVE-2020-2120
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
CVE-2020-2120
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
CVE-2020-2120
The CVE-2020-2120 relates to Jenkins FitNesse Plugin (versions 1.30 and earlier) where the XML parser is not configured to disable external entities (XXE). This can allow crafted input files supplied to the plugin’s post-build step to trigger XXE processing, enabling potential extraction of secre...
PT-2020-15327 · Jenkins · Jenkins Fitnesse Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins FitNesse Plugin versions 1.30 and earlier Description: The issue allows a user who can control the input files for the post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the...
CVE-2020-2120: Improper Restriction of XML External Entity Reference
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks...
XXE vulnerability in fitnesse
fitnesse 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller...
Fitnesse Wiki Remote Command Execution Vulnerability
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient def initializeinfo...
CVE-2014-1216 - Remote Command Execution in Fitnesse Wiki
Vulnerability title: Remote Command Execution in Fitnesse Wiki CVE: CVE-2014-1216 Vendor: Fitnesse Product: Wiki Affected version: v20131110 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: The Fitnesse wiki does not validate the syntax of edited pages to validate whether the...
CVE-2014-1216
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMANDPATTERN and TESTRUNNER in the pageContent parameter when editing a page...
CVE-2014-1216
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMANDPATTERN and TESTRUNNER in the pageContent parameter when editing a page...
CVE-2014-1216
CVE-2014-1216 affects FitNesse Wiki versions including 20131110 and 20140201 and earlier. The flaw allows remote command execution by crafting pageContent with a COMMAND_PATTERN and TEST_RUNNER during page editing, enabling an attacker to run arbitrary commands on the server. Multiple public advi...