CVE-2022-25203

CVE-2022-25203 affects Jenkins Team Views Plugin 0.9.0 and earlier: it does not escape team names, enabling stored XSS when an attacker with Overall/Read permission views or interacts with the affected feature. Multiple advisories (NVD, Red Hat CNS/OSV, Nessus/NASL entries, GitHub advisories) cor...

CVE-2022-25203

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

PT-2022-17142 · Jenkins · Jenkins Team Views Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Views Plugin version 0.9.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because team names are not properly escaped, allowing attackers with Overall/Read permission to...

Stored XSS vulnerability in Team Views

Team Views 0.9.0 and earlier does not escape team names. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission. As of publication of this advisory, there is no fix. Learn why we announce this...

Jenkins 插件跨站脚本漏洞

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. JenkinsTeam Views Plugin cross-site scripting vulnerability. This vulnerability allows an attacker to execute JavaScript code on the client side...

Fancy File Delete - Moderately critical - Access Bypass - SA-CONTRIB-2022-023

This module enables you to manage and delete files. The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created. To mitigate this issue without...

Page Views Count < 2.4.15 - Unauthenticated SQL Injection

The plugin does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks...

Page Views Count < 2.4.15 - Unauthenticated SQL Injection

The plugin does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks PoC...

CVE-2021-46659

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW...

DEBIAN-CVE-2021-46659

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW...

VulnCheck KEV: CVE-2013-0322

Cross-site scripting XSS vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field...

GHSA-C6RP-XVQV-MWMF Cross-site Scripting in epubjs

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

Cross site scripting

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

CVE-2021-33040 affects FuturePress EPub.js (prior to v0.3.89). The vulnerability is a XSS in managers/views/iframe.js due to insufficient escaping of user-submitted data. Used in the EPUB rendering library; impact is cross-site scripting. Public references indicate the fix is in v0.3.89 (upstream...

Cross-site Scripting (XSS) in Apache Ambari Views

A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4...

CVE-2021-41871

An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS payload. This is executed if an administrator views the System Event Log...

Engineers Online Portal SQL注入漏洞

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...

SolarWinds Orion Platform has an unspecified vulnerability (CNVD-2021-101208)

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, and supports custom web interfaces, multiple user opinions, and map-based views of the entire network...