MAL-2022-3759 Malicious code in icons-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83ba92fd048a472e3cb8fd55e322eed6b9fbe9f052cf6750b9c24a34e67c85da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3757 Malicious code in icons-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca53637ebcf9b69a19876fca2cec6a417f55c18845d4019edd17d8e3ab2e29b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5175 Malicious code in pack-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be9ec3c538d6a4cbaf75081c6996c9c6bdae7ff861aae544eec2b9fd02162de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-MHP7-3393-PFQR Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

CVE-2022-34172

In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...

Cross site scripting

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Malicious Package

Overview @tamagoshi/icons is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

CVE-2022-34172

In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

PT-2022-22039 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.340 through 2.355 Description: The issue arises from symbol-based icons unescaping previously escaped values of tooltip parameters, resulting in a cross-site scripting XSS vulnerability. This vulnerability is known to be...

PT-2022-22048 · Jenkins · Jenkins Embeddable Build Status Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Embeddable Build Status Plugin versions 2.0.3 and earlier Description: The issue concerns the incorrect performance of the ViewStatus permission check in the HTTP endpoint provided for "unprotected" status badge access. This allows...

PT-2022-22038 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.321 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3 Description: The HTML output generated for new symbol-based SVG icons in Jenkins includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute...

Malicious code in uitk-react-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3380ff8083f7054138496758ebd9a9e976927217afe13950fd8c32eae583b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6763 Malicious code in uitk-react-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3380ff8083f7054138496758ebd9a9e976927217afe13950fd8c32eae583b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cm.icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82882ce314ad2b57a73f7dd4b134c17f6dad7972db0b8dcb9bf132038c3ea616 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7380 Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usaa-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e90c6fdc6fe30d9e6c691dbeaa35acfdcb80c4b0f64b12cc5173fc9d1f2da369 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...