Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs. Shortcut Job Plugin 0.5 escapes the shortcut redirection URL...

CVE-2023-40348

The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output...

CVE-2023-40346

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs...

CVE-2023-40346

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs...

Cross site scripting

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs...

CVE-2023-40346

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs...

CVE-2023-40346

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure shortcut jobs...

CVE-2023-40346

Jenkins Shortcut Job Plugin 0.4 and earlier has a stored XSS vulnerability due to not escaping the shortcut redirection URL, exploitable by attackers who can configure shortcut jobs. The advisory notes that Shortcut Job Plugin 0.5 escapes the shortcut redirection URL, mitigating the issue. Affect...

PT-2023-27404 · Jenkins · Jenkins Shortcut Job Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Shortcut Job Plugin versions 0.4 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the Jenkins Shortcut Job Plugin does not escape the shortcut redirection URL, making ...

Jenkins Plugin Shortcut Job 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site scripting...

PT-2023-27405 · Jenkins · Jenkins Gogs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin versions 1.0.15 and earlier Description: The webhook endpoint in Jenkins Gogs Plugin provides unauthenticated attackers with information about the existence of jobs in its output. This endpoint, located at "/gogs-webhook",...

PT-2023-27406 · Jenkins · Jenkins Gogs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin versions 1.0.15 and earlier Description: The Jenkins Gogs Plugin improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs. The plugin provides a webhook...

Jenkins Plugin Gogs 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-3328 Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS

The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2023-3328

CVE-2023-3328 affects the WordPress plugin Custom Field For WP Job Manager and is due to insufficient sanitization/escaping of certain settings in versions prior to 1.2. This allows Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, including multisite setu...

CVE-2023-3328 Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS

The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

Cross-Site Request Forgery (CSRF)

com.xuxueli:xxl-job is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in xxl-job-admin/user/add, which allows an attacker to use a crafted .html file to cause CSRF attacks due to insufficient checks, resulting in arbitrary code execution and privilege escalations...

PT-2023-24264 · WordPress · Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: The Custom Field For WP Job Manager WordPress plugin versions prior to 1.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is...

WordPress plugin Custom Field For WP Job Manager Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

ScienceLogic SL1 SQL Injection Vulnerability (CNVD-2023-66419)

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A SQL injection vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from a lack of validation of externally entered SQL...