CVE-2023-32999

A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials...

CVE-2023-32999

A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32996

Jenkins SAML SSO Plugin (versions ≤ 2.0.0) has a missing permission check on an HTTP endpoint, enabling attackers with Overall/Read to send attacker-specified JSON to miniOrange’s API for sending emails and triggering a CSRF-like risk. The issue is formally associated with CVE-2023-32996. Mitigat...

CVE-2023-32995

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32995

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32995

CVE-2023-32995 is a CSRF vulnerability in Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.0 and earlier. The flaw allows an attacker with Overall/Read permission to trigger an HTTP POST with a JSON body to miniOrange’s API for sending emails due to a missing/unchecked permission check on an ...

PT-2023-24129

Name of the Vulnerable Software and Affected Versions Jenkins AppSpider Plugin versions 1.0.15 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of...

CVE-2023-32998: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials...

CVE-2023-32999: Incorrect Default Permissions

A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials...

CVE-2023-32996: Incorrect Default Permissions

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32995: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

PT-2023-24130

Name of the Vulnerable Software and Affected Versions Jenkins AppSpider Plugin versions 1.0.15 and earlier Description A missing permission check in the Jenkins AppSpider Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request wit...

Jenkins AppSpider Plugin security vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Sql injection

A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=saveservice of the component HTTP POST Request Handler. The manipulation of the argument...

CVE-2023-2344 SourceCodester Service Provider Management System HTTP POST Request sql injection

A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=saveservice of the component HTTP POST Request Handler. The manipulation of the argument...

CVE-2023-2344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=saveservice of the component HTTP POST Request Handler. The manipulation of the argument...

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Description There is a taint path can store payload into the database. visit http://127.0.0.1/corebos-master/index.php?action=PickList&module=PickList and click Add Item, the Add new entries here: can be tainted. Although there has a front limitation, but we can bypass it by modifying the request...