WordPress Ninja Job Board plugin <= 1.3.1 - Resume Disclosure via Directory Listing

Resume Disclosure via Directory Listing discovered by Daniel Ruf in WordPress Ninja Job Board plugin versions = 1.3.1. Solution Update the WordPress Ninja Job Board plugin to the latest available version at least 1.3.3...

WordPress Simple Job Board plugin <= 2.9.6 - Resume Disclosure via Directory Listing

Resume Disclosure via Directory Listing was discovered by Daniel Ruf in the WordPress Simple Job Board plugin versions = 2.9.6. Solution Update the WordPress Simple Job Board plugin to the latest available version at least 2.10.0...

Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing

The plugin does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes. curl https://example.com/wp-content/uploads/wpjobboard Search for this path / folder in search engines to find...

Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing

The plugin is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. curl https://example.com/wp-content/uploads/jobpost Search for this path / folder in search engines to find uploaded resumes...

Threat Source newsletter (July 28, 2022) — What constitutes an "entry-level" job in cybersecurity?

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Between the White House’s recent meeting, countless conference talks and report after report warning of cybersecurity burnout, there’s been a ton of talk recently around the cybersecurity skills...

GHSA-6X63-HRXG-2HJX External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint

Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to create runs of an external job. External Monitor Job Type Plugin...

Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

GHSA-M8W5-VWQ3-GP8F Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

Insufficient Permission Check

Jenkins git plugin is vulnerable to an insufficient permission check. An unauthenticated attacker can trigger builds to a malicious GIT repository, changing the job configuration...

CVE-2022-36887

A cross-site request forgery CSRF vulnerability in Jenkins Job Configuration History Plugin 1155.v28a46acc06a5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations...

CVE-2022-36886

A cross-site request forgery CSRF vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job...

CVE-2022-36887

A cross-site request forgery CSRF vulnerability in Jenkins Job Configuration History Plugin 1155.v28a46acc06a5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations...

CVE-2022-36886

A cross-site request forgery CSRF vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job...

CVE-2022-36887

A cross-site request forgery CSRF vulnerability in Jenkins Job Configuration History Plugin 1155.v28a46acc06a5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations...

CVE-2022-36886

A cross-site request forgery CSRF vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job...

CVE-2022-36884

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository...

CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job...

CVE-2022-36910

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

CVE-2022-36910

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...