CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2018-07822)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...

Jenkins TestLink Plugin Cross-Site Scripting Vulnerability

Jenkins is an open source software project , is based on Java development of a continuous integration tool . A cross-site scripting vulnerability exists in TestLinkBuildAction/summary.jelly and other scripts in Jenkins TestLink Plugin 2.12 and earlier versions, which stems from a program that mak...

Apache Commons Jelly Security Bypass Vulnerability

Apache Commons Jelly is the United States Apache Apache Software Foundation of a Java and XML-based scripting engine . A security vulnerability exists in Apache Commons Jelly version 1.0. An attacker can exploit this vulnerability to bypass security restrictions and perform unauthorized operation...

XML External Entity (XXE)

Apache commons-jelly is vulnerable to XML external entity XXE. When jelly XML files are parsed with a custom doctype declared as a SYSTEM entity with a URL at the beginning of the file, the parser will connect to the URL at instantiation...

CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

Xxe

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

UBUNTU-CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

Apache Commons Jelly connects to url with certain custom doctype definitions.

Severity: Medium Vendor: The Apache Software Foundation Versions Affected: commons-jelly-1.0 core, namely commons-jelly-1.0.jar Description: During jelly xml file parsing with xerces, if a custom doctype entity is declared with a ?SYSTEM? entity with a url and that entity is used in the body of t...

CVE-2017-12621

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

CVE-2017-12621

The CVE-2017-12621 issue is an XXE vulnerability in Apache Commons Jelly when parsing Jelly XML and a SYSTEM entity URL is used in the document, causing the parser to connect to that URL during instantiation. Affected version: Apache Commons Jelly before 1.0.1. Impact per sources indicates potent...

PT-2017-12606 · Apache · Apache Commons Jelly +1

Name of the Vulnerable Software and Affected Versions: Apache Commons Jelly versions prior to 1.0.1 Description: The issue arises during Jelly xml file parsing with Apache Xerces. If a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the...

CVE-2016-6799

Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition...

Jelly Band - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Band published at the 'play' market has multiple vulnerabilities...

Jelly 8 - color shape for kids - External URLs, Possible privilege escalation, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Jelly 8 - color shape for kids published at the 'play' market has multiple vulnerabilities...

Jelly Heroes - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Heroes published at the 'play' market has multiple vulnerabilities...

Jelly Madness - MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Madness published at the 'play' market has multiple vulnerabilities...

Jelly Jiggle - Jelly Match 3 - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Jiggle - Jelly Match 3 published at the 'play' market has multiple vulnerabilities...

Jelly Blast-Candy Trip - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Blast-Candy Trip published at the 'play' market has multiple vulnerabilities...