CVE-2015-5298

The Google Login Plugin versions 1.0 and 1.1 allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification...

CVE-2015-5298

The Google Login Plugin versions 1.0 and 1.1 allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification...

CVE-2015-5298

The CVE-2015-5298 entry concerns the Jenkins Google Login Plugin versions 1.0 and 1.1. The vulnerability arises from client-side request modification that bypasses domain-restriction controls, allowing malicious anonymous users to authenticate against Jenkins instances that should be limited to a...

CVE-2015-5298

The Google Login Plugin versions 1.0 and 1.1 allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification...

CVE-2017-20098

A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting Persistent. It is possible to launch the attack remotely...

Cross site scripting

A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting Persistent. It is possible to launch the attack remotely...

CVE-2017-20098 Admin Custom Login Plugin Persistent cross site scripting

A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting Persistent. It is possible to launch the attack remotely...

CVE-2017-20098 Admin Custom Login Plugin Persistent cross site scripting

A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting Persistent. It is possible to launch the attack remotely...

CVE-2017-20098

CVE-2017-20098 affects the WordPress Admin Custom Login Plugin version 2.4.5.2. The issue is described as a manipulation of an unknown function that leads to basic persistent cross-site scripting (XSS). The vulnerability is reported as exploitable remotely. Several connected sources (Red Hat, CNV...

CVE-2022-1589

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector...

hudson.plugins.concurrent_login:concurrent-login-plugin (>=0.5 <=0.7), org.jenkins-ci.main:jenkins-test-harness (=1.513) +4 more potentially affected by CVE-2013-2034 via org.jenkins-ci.main:jenkins-core (=1.513)

org.jenkins-ci.main:jenkins-core MAVEN version =1.513 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - hudson.plugins.concurrentlogin:concurrent-login-plugin =0.5, =0.7 -...

Jenkins Google Login Plugin Open Redirect vulnerability

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs...

GHSA-RP82-XVG3-727C Jenkins Google Login Plugin Session Fixation vulnerability

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Google Login Plugin 1.3.1 invalidates the previous session...

Jenkins Google Login Plugin Session Fixation vulnerability

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Google Login Plugin 1.3.1 invalidates the previous session...

hudson.plugins.concurrent_login:concurrent-login-plugin (>=0.5 <=0.7), org.jenkins-ci.main:jenkins-test-harness (=1.513) +4 more potentially affected by CVE-2013-2033 via org.jenkins-ci.main:jenkins-core (=1.513)

org.jenkins-ci.main:jenkins-core MAVEN version =1.513 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - hudson.plugins.concurrentlogin:concurrent-login-plugin =0.5, =0.7 -...

CVE-2022-0593

The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation...

CVE-2021-24998

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

CVE-2021-43409

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An Access Control Error vulnerability exists in the WordPress Simple JWT Login plugin in versions prior to...

WordPress Microsoft Office 365 / Azure AD | LOGIN plugin <= 11.6 - JWT Signature Verification Bypass vulnerability

JWT Signature Verification Bypass vulnerability found by Philip Akesson in WordPress Microsoft Office 365 / Azure AD | LOGIN plugin versions = 11.6. Solution Update the WordPress Microsoft Office 365 / Azure AD | LOGIN plugin to the latest available version at least 11.7...