PYSEC-2023-210

views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...

CVE-2021-46897

views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...

CVE-2021-46897

CVE-2021-46897 affects Wagtail CRX CodeRed Extensions (formerly CodeRed CMS/coderedcms) prior to 0.22.3. The vulnerability is a path traversal flaw in views.py that allows upward traversal (..%2f..%2f) when serving protected media, as documented across multiple sources (GitHub issues/PRs and vend...

CVE-2021-46897

views.py in Wagtail CRX CodeRed Extensions formerly CodeRed CMS or coderedcms before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media...

Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

GHSA-HC44-P2QQ-CFM9 Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Jenkins CRX Content Package Deployer Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. a cross-site scripting vulnerability exists in Jenkins CRX Content Package...

CVE-2022-34184

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34184

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34184

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Cross site scripting

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34184

CVE-2022-34184 affects Jenkins CRX Content Package Deployer Plugin 1.9 and earlier. The issue is that the name and description of CRX Content Package Choice parameters are not escaped on parameter views, causing stored XSS exploitable by attackers with Item/Configure permission. Connected sources...

CVE-2022-34184

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-22052 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins CRX Content Package Deployer Plugin versions 1.9 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the plugin does not escape the name and description of CRX Content Package Choi...

Jenkins Plugin CRX Content Package Deployer 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plug-ins to support building, deploying, and automating any project. a cross-site scripting vulnerability exists in Jenkins CRX Content Package...

MAL-2022-1670 Malicious code in brave-core-crx-packager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d659bff6641ae2eba134b7096de9c5134287f99bb6aad5396c9f30be533d099 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brave-core-crx-packager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d659bff6641ae2eba134b7096de9c5134287f99bb6aad5396c9f30be533d099 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-4CMQ-88F8-53R5 Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is patched in version 1.9...

Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is patched in version 1.9...

Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...