135 matches found
CVE-2023-25763
Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control affected fields...
PT-2023-20288
Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Plugin versions 2.93 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not escape, sanitize, or sandbox rendered email template output or...
WordPress MainWP Rocket Extension Plugin <= 4.0.3 is vulnerable to Settings Change
Software MainWP Rocket Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.0.4 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23665 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 5dab77b10cf4 Credits Dave Jong Patchstack...
GHSA-CCR8-4XR7-CGJ3 Sandbox bypass vulnerability in Jenkins Script Security Plugin
Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call ...
GHSA-4QRJ-99R6-JFRH Missing hostname validation in Email Extension Plugin
Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. Email Extension Plugin 2.76 validates the SMTP hostname when...
Missing hostname validation in Email Extension Plugin
Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. Email Extension Plugin 2.76 validates the SMTP hostname when...
GHSA-VP55-FHXX-VCX8 Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. It is vulnerable to, in the worst case, Remote Code Execution, and in the general case, local privilege escalation. Internally, the plugin uses a socket connection to send serialized Java objects that are...
GHSA-5C4V-VH95-C67C Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text
Email Extension Plugin stores an SMTP password in its global configuration file hudson.plugins.emailext.ExtendedEmailPublisher.xml on the Jenkins controller as part of its configuration. While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the...
Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text
Email Extension Plugin stores an SMTP password in its global configuration file hudson.plugins.emailext.ExtendedEmailPublisher.xml on the Jenkins controller as part of its configuration. While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the...
GHSA-C8QR-VFJF-62Q3 Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...
Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...
GHSA-QWM8-VGM6-F86P Script security sandbox bypass in Jenkins Email Extension Plugin
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java,...
Script security sandbox bypass in Jenkins Email Extension Plugin
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java,...
CVE-2022-27203
Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...
PT-2021-6417
Name of the Vulnerable Software and Affected Versions Web Media Extensions affected versions not specified Description The issue is related to a remote code execution vulnerability. It involves incorrect code generation management in the Raw Image Extension plugin for viewing RAW images...
Sandbox bypass vulnerability in script-security
script-security provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowe...
CVE-2020-2253
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server...
CVE-2020-2253
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server...
