CVE-2022-34191

CVE-2022-34191 refers to a stored XSS vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin, affecting version 4.8.0.77 and earlier. The issue arises because the plugin does not escape the name of NetStorm Test parameters on views that display parameters, enabling an attacker wi...

Jenkins Plugin Squash TM Publisher 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Squash TM Publisher Plugin 1.0.0...

PT-2022-22084 · Jenkins · Jenkins Squash Tm Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Squash TM Publisher Squash4Jenkins Plugin versions 1.0.0 and earlier Description: The issue allows passwords to be stored unencrypted in the global configuration file on the Jenkins controller, making them accessible to users with...

Jenkins Plugin NS-ND Integration Performance Publisher 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins NS-ND Integration Performance...

Malicious code in types-publisher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c5e10c0aa349b60675cf999eed9975b810b50e1a6ae2765872fe8181595e355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6713 Malicious code in types-publisher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c5e10c0aa349b60675cf999eed9975b810b50e1a6ae2765872fe8181595e355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Path traversal for local publishers in TechDocs backend

Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catalog must be...

The vulnerability of the E-Business Suite component XDO, a reporting tool within the Oracle BI Publisher software from Oracle Fusion Middleware, allows an intruder to gain unauthorized access to protected information.

The vulnerability of the E-Business Suite component XDO, a reporting tool within the Oracle BI Publisher software from Oracle Fusion Middleware, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

Security Updates for Microsoft Publisher Products C2R (April 2020)

The Microsoft Publisher Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries. An attacker could then install programs; view, change, or...

The vulnerability of the Scheduler sub-component of the Oracle BI Publisher software, a component of the Oracle Fusion Middleware software platform. This vulnerability allows an attacker to execute arbitrary code, as well as to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Scheduler sub-component of the Oracle BI Publisher software component of the Oracle Fusion Middleware software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely, as well as...

GHSA-WMH9-X28J-C6GR Cross site scripting in publify

In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article...

Cross-site Scripting (XSS)

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to unrestricted file upload. This issue allows a user with a “publisher” role to inject malicious JavaScript code via the...

Cross site scripting in publify

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file...

Jenkins Gem Publisher Plugin stores credentials as plaintext

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-6PQM-PP65-MC26 Jenkins Gem Publisher Plugin stores credentials as plaintext

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

com.liferay:com.liferay.asset.publisher.web (>=1.0.0 <=1.8.11), com.liferay:com.liferay.blogs.web (>=1.0.0 <=2.0.4) +3 more potentially affected by CVE-2021-33320 via com.liferay:com.liferay.flags.taglib (=2.0.0)

com.liferay:com.liferay.flags.taglib MAVEN version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay:com.liferay.flags.taglib and may be impacted: - com.liferay:com.liferay.asset.publisher.web =1.0.0, =1.0.0, =2.0.0, =1.0.0, =1.3.0...

GHSA-JVVX-8G42-9559 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App

Cross-site scripting XSS vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App

Cross-site scripting XSS vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

GHSA-JFGP-Q2HG-W285 WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...

WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...