CVE-2022-27197

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...

CVE-2022-27203

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

CVE-2022-27203

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

CVE-2022-27202

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-27202

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

Cross site scripting

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission...

CVE-2022-27202

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Jenkins Favorite Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Configure or Item/Create privileges could be exploited to cause a stored cross-site...

PT-2022-18290 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: The issue allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...

PT-2022-18301 · Jenkins · Jenkins Environment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Environment Dashboard Plugin versions 1.1.10 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the Environment order and the Component order configuration values in the...

GHSA-29VR-79W7-P649 Duplicate Advisory: Incorrect Authorization in Gerapy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references. Original Description An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in projectconfigure function...

Duplicate Advisory: Incorrect Authorization in Gerapy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references. Original Description An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in projectconfigure function...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

编号撤回

Gerapy is a distributed crawler management framework based on Scrapy, Scrapyd, Django and Vue.js. A security vulnerability exists in Gerapy v 0.9.7, which stems from an access control vulnerability that can be caused by the spider parameter in the projectconfigure function. No details of the...

PT-2022-12183 · Gerapy · Gerapy

Name of the Vulnerable Software and Affected Versions: Gerapy version 0.9.7 Description: An Access Control issue exists in Gerapy via the spider parameter in the project configure function. Recommendations: For Gerapy version 0.9.7, consider restricting access to the project configure function...

Reflected Cross-site Scripting (XSS) Vulnerability

Description hestiacp is vulnerable to Reflected XSS in the Hostname field within Basic Options of the function "Configure Server" in Hestia Control Panel Proof of Concept 1 Access https://demo.hestiacp.com:8083/edit/server/ 2 Click "Configure" 3 Click Basic Options 4 Enter below as payload in the...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...