CVE-2022-1822

The CVE concerns the WordPress Zephyr Project Manager plugin (versions up to and including 3.2.40). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability in the project parameter caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to injec...

WordPress plugin Zephyr Project Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2022-14141

Name of the Vulnerable Software and Affected Versions Zephyr Project Manager plugin for WordPress versions up to, and including, 3.2.40 Description The issue arises from insufficient input sanitization and output escaping, making it possible for unauthenticated attackers to inject arbitrary web...

GHSA-56WF-MX5C-FFJX CSRF vulnerability in Jenkins Zephyr for JIRA Test Management Plugin

A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password...

GHSA-2Q7J-52XG-X8FM Missing permission checks in Zephyr for JIRA Test Management Plugin

A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password...

CSRF vulnerability in Jenkins Zephyr for JIRA Test Management Plugin

A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password...

Missing permission checks in Zephyr for JIRA Test Management Plugin

A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password...

Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text

Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-M365-98J8-W96W Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text

Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Credentials stored in plain text by Zephyr Enterprise Test Management Plugin

Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. Zephyr Enterprise Test...

GHSA-XV58-GP43-6M76 Credentials stored in plain text by Zephyr Enterprise Test Management Plugin

Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file com.thed.zephyr.jenkins.reporter.ZeeReporter.xml. This password can be viewed by users with access to the Jenkins controller file system. Zephyr Enterprise Test...

Zephyr Project Manager < 3.2.41 - Reflected Cross-Site Scripting

The plugin does not escape and sanitise the project parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting...

WordPress Zephyr Project Manager plugin <= 3.2.40 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Eduardo Estevao de Oliveira Azevedo in WordPress Zephyr Project Manager plugin versions = 3.2.40. Solution Update the WordPress Zephyr Project Manager plugin to the latest available version at least 3.2.41...

Fedora: Security Advisory for pidgin (FEDORA-2022-4490dce823)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: pidgin-2.14.6-3.fc35

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just add an...

GHSA-QJ8P-C733-V494 CSRF vulnerability in Zephyr Enterprise Test Management Plugin

A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CSRF vulnerability in Zephyr Enterprise Test Management Plugin

A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

GHSA-4P5R-2M5C-HVCC Jenkins Zephyr Enterprise Test Management Plugin missing permission check

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Jenkins Zephyr Enterprise Test Management Plugin missing permission check

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

[Security Nation] Kate Stewart on Open-Source Projects at the Linux Foundation

!\Security Nation\ Kate Stewart on Open-Source Projects at the Linux Foundationhttps://blog.rapid7.com/content/images/2022/04/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the...