MSC-2022-10429

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2022-6646

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2022-10354

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

GHSA-WMH9-X28J-C6GR Cross site scripting in publify

In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article...

Cross site scripting in publify

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file...

Cross-site Scripting (XSS)

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to unrestricted file upload. This issue allows a user with a “publisher” role to inject malicious JavaScript code via the...

Jenkins Gem Publisher Plugin stores credentials as plaintext

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-6PQM-PP65-MC26 Jenkins Gem Publisher Plugin stores credentials as plaintext

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-JVVX-8G42-9559 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App

Cross-site scripting XSS vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App

Cross-site scripting XSS vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...

GHSA-JFGP-Q2HG-W285 WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...

Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration

S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by S3 publisher Plugin 0.11.4 and earlier. This can result in exposure of the credential through browser...

GHSA-FFR6-8CV5-J637 Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration

S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by S3 publisher Plugin 0.11.4 and earlier. This can result in exposure of the credential through browser...

Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting

Jenkins HTML Publisher Plugin prior to version 1.21 did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those. This issue has been patched in version 1.21...

GHSA-Q829-HRMC-84C8 Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting

Jenkins HTML Publisher Plugin prior to version 1.21 did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those. This issue has been patched in version 1.21...

Missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin

A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server...

GHSA-PV88-89RQ-9FG6 Missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin

A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server...

PT-2022-4736

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects BW Publisher Service versions 420, 430 Description The issue is related to the absence of quotes in writing elements or search paths, which can be exploited by a local attacker to gain elevated privileges by inserting an...

MSC-2022-10493

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...