CVE-2022-34180

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

Path traversal

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

CVE-2022-34180

CVE-2022-34180 concerns the Jenkins Embeddable Build Status Plugin ( versions 2.0.3 and earlier ). The issue is that the plugin does not correctly perform the ViewStatus permission check in the HTTP endpoint used for unprotected status badge access. As a result, attackers with no permissions can ...

CVE-2022-34180

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

CVE-2022-34179

CVE-2022-34179 affects Jenkins Embeddable Build Status Plugin, version 2.0.3 and earlier. The vulnerability arises from an unrestricted style query parameter used to select SVG image styles, enabling relative path traversal to SVGs on the Jenkins controller filesystem. Exploitation is possible wi...

CVE-2022-34178

CVE-2022-34178 affects Jenkins’ Embeddable Build Status Plugin (version 2.0.3). The vulnerability is a reflected XSS caused by accepting an unrestricted link query parameter in the badge URL, which can be reflected in the UI. The issue is addressed in the fixed release 2.0.4, which limits URLs to...

CVE-2022-34180: Incorrect Authorization

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified j...

CVE-2022-34178: Improper Neutralization of Input During Web Page Generation

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2022-34179: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

Reflected XSS vulnerability in embeddable-build-status

embeddable-build-status 2.0.3 allows specifying a link query parameter that build status badges will link to, without restricting possible values. This results in a reflected cross-site scripting XSS vulnerability. embeddable-build-status 2.0.4 limits URLs to http and https protocols and correctl...

Path traversal vulnerability in embeddable-build-status

embeddable-build-status 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values. This results in a relative path traversal vulnerability, allowing attackers without Overall/Read permission to specify paths ...

Improper authorization in embeddable-build-status bypasses ViewStatus permission requirement

embeddable-build-status 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access. This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or...

Jenkins Plugin Embeddable Build Status 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that is vulnerable to an authorization issue in Jenkins Embeddable Build Status Plugin 2.0.3 and earlier, which stems from an inability to properly perform a ViewStatus...

MAL-2022-5725 Malicious code in redtail-embeddable-ringcentral-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37e5c999eca221f2f5469510f6d07da2dbc50c0975f465433eaa4eaccbc506c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redtail-embeddable-ringcentral-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37e5c999eca221f2f5469510f6d07da2dbc50c0975f465433eaa4eaccbc506c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pipedrive-embeddable-ringcentral-phone-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bc150e5ccb4209c706e7a4df2edfb54c9bbe1fc826a89a7bc5f011fe54676a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5341 Malicious code in pipedrive-embeddable-ringcentral-phone-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bc150e5ccb4209c706e7a4df2edfb54c9bbe1fc826a89a7bc5f011fe54676a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pipedrive-embeddable-engage-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d86a390ab51c1f55c23ea94dbf9a4faf91454d565be06c287514428ec0a36de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5340 Malicious code in pipedrive-embeddable-engage-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d86a390ab51c1f55c23ea94dbf9a4faf91454d565be06c287514428ec0a36de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2743 Malicious code in engage-voice-embeddable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3893913d5991d5888f072fb5bbf309b8b7010adaaa82fc42e345e155e3176c90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...