CVE-2022-25207

A cross-site request forgery CSRF vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response...

CVE-2022-25209

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-25208

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response...

Xxe

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

Design/Logic Flaw

A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response...

CVE-2022-25209

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-25209

CVE-2022-25209 affects the Jenkins Chef Sinatra Plugin (versions 1.20 and earlier). The root cause is that the plugin does not configure its XML parser to prevent XML External Entity (XXE) attacks, enabling crafted XML responses to be parsed with potential exposure of secrets from the Jenkins con...

CVE-2022-25208

Affected software: Jenkins Chef Sinatra Plugin (versions 1.20 and earlier). Root cause: Missing permission checks in a form validation method allow an attacker with Overall/Read permission to cause Jenkins to send an HTTP request to an attacker-controlled URL and parse the XML response; the XML p...

CVE-2022-25207

A cross-site request forgery CSRF vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response...

CVE-2022-25207

Jenkins Chef Sinatra Plugin 1.20 and earlier is affected by a CSRF vulnerability. Affected component: the plugin’s form validation flow; root cause: insufficient protection allows an attacker with Overall/Read permission to have Jenkins send requests to an attacker‑controlled URL and parse the XM...

PT-2022-17147 · Jenkins · Jenkins Chef Sinatra Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin versions 1.20 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an...

PT-2022-17148 · Jenkins · Jenkins Chef Sinatra Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin versions 1.20 and earlier Description: The issue arises from the plugin not configuring its XML parser to prevent XML external entity XXE attacks, allowing attackers to have Jenkins parse a crafted XML response for...

Jenkins 插件跨站请求伪造漏洞

The Jenkins Plugin is a plug-in that provides functionality for Jenkins. The Jenkins Chef Sinatra Plugin Cross-Site Request Forgery vulnerability allows an attacker to send an HTTP request from Jenkins to a URL that can be controlled using this vulnerability...

chefselection.co.uk Improper Access Control vulnerability OBB-2234687

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SAP Business One Code Injection Vulnerability (CNVD-2022-58479)

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One Hana Chef Cookbook contains a code injection vulnerability that could be exploited to inject code that can be executed by the application...

SAP Business One Information Disclosure Vulnerability (CNVD-2022-58480)

SAP Business One is a suite of enterprise management software from SAP, a German company. The software includes financial management, operations management and human resources management functions.SAP Business One Chef cookbook contains an information disclosure vulnerability that could be...

CVE-2021-27613

Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted, which could lead to...

CVE-2021-27616

Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted, resulting in...

CVE-2021-27614

SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application thereby highly impacting the...