3639 matches found
CVE-2026-42524
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
EUVD-2026-26226
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-42524
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-42524
The Jenkins HTML Publisher Plugin (versions 427 and earlier) is vulnerable to a stored cross-site scripting (XSS) attack because it fails to escape the job name and URL within the legacy wrapper file. Attackers with Item/Configure permissions can exploit this to execute malicious scripts. To reme...
CVE-2026-42524
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Jenkins HTML Publisher Plugin 跨站脚本漏洞
The Jenkins HTML Publisher Plugin is an open-source continuous integration plugin developed by Jenkins, designed for publishing and displaying HTML reports generated by builds. The Jenkins HTML Publisher Plugin versions 427 and earlier contained a cross-site scripting vulnerability. This...
CVE-2026-42524: Improper Neutralization of Input During Web Page Generation
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
PT-2026-35918
Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions prior to 428 Description Stored cross-site scripting XSS occurs because the legacy wrapper file fails to escape the job name and URL. This allows attackers with Item/Configure permissions to execute...
GHSA-W5HQ-G745-H8PQ
creationtimestamp| type| source ---|---|--- 2026-04-23 12:01:01+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mk5xnhyzsk2o 2026-05-05 06:40:28+00:00| seen| https://gist.github.com/alon710/cc4d9b85509a9bc85167e4592e568bc8 2026-05-07 12:01:09+00:00| seen|...
Malicious code in modern-events (npm)
modern-events is a malicious npm package that when imported and using the function EventEmitter.emit... in file events.js exfiltrates local system information via telegram and slack and downloads a backdoor Win64/FaxedCook to C:/ProgramData/Policy/PublisherPolicy.tms. --- -= Per source details. D...
MAL-2026-2914 Malicious code in modern-events (npm)
modern-events is a malicious npm package that when imported and using the function EventEmitter.emit... in file events.js exfiltrates local system information via telegram and slack and downloads a backdoor Win64/FaxedCook to C:/ProgramData/Policy/PublisherPolicy.tms. --- -= Per source details. D...
EUVD-2024-55549
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...
CVE-2024-8010 XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...
CVE-2024-8010 XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...
CVE-2024-8010
The CVE-2024-8010 entry concerns an XML External Entity (XXE) injection in WSO2 API Manager where XML input accepted through the publisher does not disable external entity resolution. This allows a remote attacker to read confidential files from the product’s filesystem or access limited HTTP res...
WSO2 API Manager 安全漏洞
The WSO2 API Manager is a set of API lifecycle management solutions provided by the American company WSO2. There is a security vulnerability present in the WSO2 API Manager publishers. This vulnerability stems from the component’s inability to disable external entity resolution when accepting XML...
CVE-2026-39698 WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through = 1.5.0...
CVE-2026-39698
CVE-2026-39698 affects the WordPress plugin The Publisher Desk ads.txt (publisher-desk-ads-txt) with versions up to and including 1.5.0. The root cause is missing authorization due to incorrectly configured access control, enabling potential exploitation through insufficient access restrictions. ...
CVE-2026-39698 WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through = 1.5.0...
CVE-2026-39698: Missing Authorization
Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through = 1.5.0...