152 matches found
CVE-2021-21632
A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins...
PT-2021-14675 · Jenkins · Jenkins Owasp Dependency-Track Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OWASP Dependency-Track Plugin versions 3.1.0 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in...
Dependency-Track 安全漏洞
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An improper authorization...
Jenkins OWASP Dependency-Track 跨站请求伪造漏洞
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...
PT-2021-14676 · Jenkins · Jenkins Owasp Dependency-Track Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OWASP Dependency-Track Plugin versions 3.1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins. The issue arises...
CSRF vulnerability and missing permission checks in dependency-track allow capturing credentials
dependency-track 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing "Secret text" credentials...
frontend
!Build Statushttps://github.com/DependencyTrack/frontend/act...
CVE-2019-1020007
Dependency-Track before 3.5.1 allows XSS...
CVE-2019-1020007
Dependency-Track before 3.5.1 allows XSS...
Cross site scripting
Dependency-Track before 3.5.1 allows XSS...
CVE-2019-1020007
Dependency-Track (before version 3.5.1) is affected by CVE-2019-1020007, a cross-site scripting (XSS) vulnerability. The connected documents confirm XSS but do not provide details on root cause, exploit specifics, or a listed fix within the provided data.