Jenkins Edgewall Trac Plugin vulnerable to Stored XSS

Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

GHSA-66HV-FHCM-7XM7 Jenkins Warnings Plugin exposures system-scoped credentials

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are no...

CVE-2023-46650

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

Cross site scripting

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2023-46651

Affected software: Jenkins Warnings Plugin, version 10.5.0 and earlier (backport fix to 10.4.1). Vulnerability: The plugin does not set the appropriate context for credentials lookup, allowing users with Item/Configure permission to access credentials they are not entitled to. Impact: Potential u...

Stored XSS vulnerability in github

github 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. github 1.37.3.1 escapes GitHub project URL on the build page when showi...

PT-2023-30145 · Jenkins · Jenkins Edgewall Trac Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Edgewall Trac Plugin versions 1.13 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because the Trac website URL on the build page is not escaped. This vulnerability is exploitable by...

PT-2023-6484 · Jenkins · Jenkins Warnings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Plugin versions 10.5.0 and earlier Description: The issue is related to information disclosure, allowing remote attackers to gain unauthorized access to protected information. Specifically, it does not set the appropriate...

Upgraded Q -> 3 from #839 [1698131435131]

Judge has assessed an item in Issue 839 as 3 risk. The relevant finding follows: UniV3LiquidityAMO: recoverERC721 does not, in fact, recovers them The function to recover ERC721’s found here sends them to the rDPX V2 core contract, however said contract has no function to retrieve them, rendering...

Upgraded Q -> 2 from #671 [1697894602524]

Judge has assessed an item in Issue 671 as 2 risk. The relevant finding follows: Low-02: It may become economically feasible to coerce depositNonce to overflow --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items...

Design/Logic Flaw

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki that stems from a Wikibase extension that does not r...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45371

CVE-2023-45371 affects the Wikibase extension for MediaWiki. The issue is a lack of rate limiting for merging items, which can lead to unintended merging actions and potential data integrity concerns across multiple versions. Affected versions are: MediaWiki with Wikibase before 1.35.12; 1.36.x t...