Cross-Site Request Forgery (CSRF)

civicrm/civicrm-core is vulnerable to cross-site request forgery. Lack of sufficient validation on the configuration form allows a malicious third-party to trick a CiviCRM administrator into changing the configuration...

CVE-2021-21666

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2021-21666

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

Cross site scripting

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

PT-2021-14709 · Jenkins · Jenkins Kiuwan Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Kiuwan Plugin versions 1.6.0 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the Jenkins Kiuwan Plugin does not escape query parameters in an error message for a...

CVE-2021-21666: Improper Neutralization of Input During Web Page Generation

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

PT-2021-14707 · Xebialabs +1 · Jenkins Xebialabs Xl Deploy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier Description: An incorrect permission check in the Jenkins XebiaLabs XL Deploy Plugin allows attackers with Generic Create permission to connect to an attacker-specified URL using...

Reflected XSS vulnerability in kiuwanJenkinsPlugin

kiuwanJenkinsPlugin 1.6.0 and earlier does not escape output that can indirectly be controlled through query parameters in an error message for a form validation endpoint. This results in a reflected cross-site scripting XSS vulnerability. NOTE: Only older releases of Jenkins are affected by this...

CVE-2021-22512

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

CVE-2021-22512

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

CVE-2021-22512

CVE-2021-22512 is a CSRF vulnerability in the Micro Focus Application Automation Tools Plugin for Jenkins (affected: 6.7 and earlier). The issue arises in form validation methods that do not perform permission checks, allowing an attacker with Overall/Read to access attacker-specified URLs using ...

CVE-2021-22512

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

CVE-2021-22512: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

CSRF vulnerability and missing permission checks in hp-application-automation-tools-plugin

hp-application-automation-tools-plugin 6.7 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. Additionally, these form...

Reflected XSS vulnerability in hp-application-automation-tools-plugin

hp-application-automation-tools-plugin 6.7 and earlier does not escape user input in a form validation response. This results in a reflected cross-site scripting XSS vulnerability. hp-application-automation-tools-plugin 6.8 escapes user input in the affected form validation response. NOTE: A...

Jenkins Core 跨站脚本漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2021-21626

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

CVE-2021-21626

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

CVE-2021-21626: Missing Authorization

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...