CVE-2018-16259

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings largefeedlimit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of b...

CVE-2018-16256

WP All Import plugin for WordPress (version 3.4.9) contains a cross-site scripting (XSS) vulnerability that can be triggered via the Add Filtering Options (Add Rule) feature. The issue is reported as present in 3.4.9 and is tied to insufficient input validation, with disclosures noting the vulner...

CVE-2018-16255

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in...

CVE-2018-16254

Summary: CVE-2018-16254 concerns an XSS vulnerability in the WordPress plugin WP All Import (version 3.4.9) exposed via the parameter action=options. The vulnerability is described as exploitable by a logged-in administrator; the vendor states it is not a vulnerability. The linked OpenVAS entry c...

PT-2019-9288 · WordPress · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import plugin version 3.4.9 Description: The issue concerns an XSS vulnerability in the WP All Import plugin for WordPress. It can be exploited via the Add Filtering Options Add Rule feature. The vendor has stated that this is not...

WordPress WP All Import plugin cross-site scripting vulnerability (CNVD-2019-30136)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP All Import plugin is used in one of the file import plugin. A cross-site scripting vulnerability exists in WordPress WP All Import...

CloudBees Jenkins Job Import Plugin XML External Entity Injection Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Job Import Plugin is used in one of the...

CVE-2019-1003017

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration...

Xxe

An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server Jenkins queried in preparation of job import to read...

CVE-2019-1003016

An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java,...

CVE-2019-1003017

The CVE-2019-1003017 entry concerns Jenkins Job Import Plugin (3.0 and earlier). The vulnerability stems from a data modification flaw in JobImportAction.java that enables attackers to copy jobs from a preconfigured external Jenkins instance, potentially installing additional plugins needed to lo...

CVE-2019-1003017

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration...

CVE-2019-1003015

Jenkins Job Import Plugin (versions ≤ 2.1) is affected by an XML External Entity (XXE) vulnerability in RestApiClient.java that lets an attacker who controls the Jenkins HTTP server read arbitrary files and can cause a Denial of Service. The issue is documented across multiple sources (CVE-2019-1...

CVE-2019-1003016

The CVE-2019-1003016 entry describes a sensitive information exposure in the Jenkins Job Import Plugin (versions 2.1 and earlier). Attackers with Overall/Read permission could cause Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs, which are obtained throug...

PT-2019-11313 · Jenkins · Jenkins Job Import Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: The issue allows attackers with control over the HTTP server queried in preparation of job import to read arbitrary files and perform a denial of service attack. This is due to a...

CVE-2019-1003015: Improper Restriction of XML External Entity Reference

An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server Jenkins queried in preparation of job import to read...

PT-2019-11315 · Jenkins · Jenkins Job Import Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 3.0 and earlier Description: A data modification issue exists that allows attackers to copy jobs from another Jenkins instance, potentially installing additional plugins to load the imported job's...

CVE-2019-1003017: Cross-Site Request Forgery (CSRF)

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration...

CVE-2019-1003016: Cross-Site Request Forgery (CSRF)

An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java,...

XXE vulnerability in Job Import Plugin

Job Import Plugin allows to import jobs from other Jenkins instances. As a first step in this process, Job Import Plugin sends a request to another Jenkins instance, parsing XML REST API output to obtain a list of jobs that could be imported. Job Import Plugin did not configure the XML parser in ...