CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2024-52552

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2024-52552: Improper Neutralization of Input During Web Page Generation

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2024-35374

Name of the Vulnerable Software and Affected Versions Jenkins Authorize Project Plugin versions 1.7.2 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. It occurs when a string containing the job name is evaluated with JavaScript on the Authorization...

Jenkins plugin Authorize Project 跨站脚本漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

Stored XSS vulnerability in authorize-project

authorize-project 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. authorize-project 1.8.0 no longer evaluates a string...

The vulnerability of the /core/authorize.php file in the Drupal CMS system allows a hacker to disclose protected information.

The vulnerability of the /core/authorize.php file in the Drupal CMS system relates to the exposure of system data by unauthorized individuals in the controlled area. Exploiting this vulnerability could allow attackers to disclose protected information through the hashsalt parameter in the...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal version 11.x-dev, which stems from a full-path disclosure issue in the core/authorize.php file, resulting in full-path information being disclosed...

GHSA-HMQF-WPQ9-JQ83 Spring Security Missing Authorization vulnerability

Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective...

Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware that provide illustrative security for Spring-based applications. A security vulnerability exists in Spring Security versions 6.3.0 and 6.3.1, which stems from a lack of authorization when using @AuthorizeReturnObject, and allows ...

Missing Authorization When Using @AuthorizeReturnObject

Applications using @AuthorizeReturnObject or the Spring Security produced AuthorizationAdvisorProxyFactory @Bean to wrap objects may not have all security advice applied. When method security advice is not applied, it means that annotations like @PreFilter and @PreAuthorize may take no affect on...

PT-2024-28230 · Unknown · Spring Security

Name of the Vulnerable Software and Affected Versions: Spring Security versions 6.3.0 through 6.3.1 Description: The issue is related to missing authorization when using @AuthorizeReturnObject in Spring Security, allowing an attacker to render security annotations ineffective. This potentially...

WordPress Authorize.net Payment Gateway For WooCommerce plugin <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass vulnerability

Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass vulnerability discovered by Lucio Sá in WordPress Plugin Authorize.net Payment Gateway For WooCommerce versions = 8.0...

CVE-2024-1089

The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optimizeAllOn function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with subscriber-level...

EmbedPress < 3.8.3 - Subscriber+ Plugin Settings Delete

Description The plugin does not properly authorize access to its adminpostremove and removeprivatedata actions, allowing low privileged users such as subscribers to delete plugin settings...

CVE-2023-2422

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...

PT-2023-3015

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0.5 Splunk Enterprise versions prior to 8.2.11 Splunk Enterprise versions prior to 8.1.14 Splunk Cloud Platform versions prior to 9.0.2303.100 Description A low-privileged user with the edit user capabilit...

pesign security update

0.112-27.0.1 - Update Oracle Linux test certificates Orabug: 31928433 - Apply pesigcheck-Mark-the-imported-certificate-as-trusted.patch Orabug: 31928433 - update Oracle Linux certificates Alexey Petrenko - remove obsoletes of pesign-rh-test-certs Orabug 29222572 0.112-27 - Deprecate...