CVE-2022-27421

Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin...

GHSA-M5CW-C64P-77H6 CSRF vulnerability in Jenkins Subversion Plugin

Subversion Plugin 2.15.3 and earlier does not require POST requests for several form validation methods, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to connect to an attacker-specified URL...

CSRF vulnerability in Jenkins Subversion Plugin

Subversion Plugin 2.15.3 and earlier does not require POST requests for several form validation methods, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to connect to an attacker-specified URL...

Jenkins JiraTestResultReporter Plugin跨站请求伪造漏洞

Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier versions are vulnerable to cross-site request forgery, which stems from a...

Missing permission check in Jenkins RocketChat Notifier Plugin

Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additionally, this form validation...

CSRF vulnerability in Jenkins RocketChat Notifier Plugin

Jenkins RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential. Additionally, this form validation...

CSRF vulnerability and missing permission check in JiraTestResultReporter

JiraTestResultReporter 165.v817928553942 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additionally, this form validation...

Jenkins JiraTestResultReporter Plugin 跨站请求伪造漏洞

Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier versions are vulnerable to cross-site request forgery, which stems from a...

Jenkins JiraTestResultReporter Plugin 访问控制错误漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins JiraTestResultReporter Plugin...

Jenkins RocketChat Notifier Plugin 访问控制错误漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins RocketChat Notifier Plugin 1.4.10 and earlier versions are vulnerable...

GHSA-X95C-QRQR-2V27 CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF

Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, these form validation methods do not require POST requests,...

PT-2022-18291 · Jenkins · Jenkins Extended Choice Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier Description: A cross-site request forgery vulnerability allows attackers to connect to an attacker-specified URL. The issue arises because the plugin does not...

Jenkins autonomiq Plugin Access Control Error Vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. an access control error vulnerability in Jenkins autonomiq Plugin 1.15 and earlier versions, which stems from not performi...

GHSA-7G7G-82FP-HPXX CSRF vulnerability in Jenkins SCP publisher Plugin

SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials. Additionally, this form validation method does...

CSRF vulnerability in Jenkins SCP publisher Plugin

SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials. Additionally, this form validation method does...

GHSA-VJ3J-8M6X-MJQ6 Missing permission check in Jenkins SCP publisher Plugin

SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials. Additionally, this form validation method does...

GHSA-38W8-H222-WRPP Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...

Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. As the plugin does not configure its XML parser to prevent XML external entity XXE attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for...

GHSA-8P8Q-WVXX-JQ94 Missing permission check in Jenkins SWAMP Plugin allows capturing credentials

SWAMP Plugin 1.2.6 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...

CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials

WAMP Plugin 1.2.6 and earlier does not perform a permission check in a method implementing form validation.\ This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials...