Cross-Site Scripting (XSS)

Jenkins is vulnerable to cross-site scripting. The vulnerability existed because it does not escape display names and IDs of item types shown on the New Item page...

CVE-2021-21611

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types...

Cross site scripting

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types...

CVE-2021-21611

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types...

PT-2021-14654 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers able to specify display names or IDs of item types shown...

CVE-2021-21611: Improper Neutralization of Input During Web Page Generation

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types...

Stored XSS vulnerability on new item page

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to specify display names or IDs of item types. NOTE: As of the publicati...

PT-2021-27501

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details include the crash type being a Heap-buffer-overflow READ 4, and the crash...

Bottelet Daybyday Crm Cross-Site Scripting Vulnerability

Bottelet Daybyday Crm is a website builder for task, time, employee, and vacation management by Bottelet Personal Developers. A cross-site scripting vulnerability exists in Daybyday 2.1.0 that allows storing XSS to the New Item screen via the title parameter...

Tangro Business Workflow Code Issue Vulnerability

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A code issue vulnerability exists in tangro Business Workflow versions prior to 1.18.1, which stems from requesting a list of...

Tangro Business Workflow Authorization Issues Vulnerability (CNVD-2020-74066)

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A vulnerability exists in Tangro Business Workflow prior to version 1.18.1 due to an authorization issue, which stems from the...

MediaWiki 跨站脚本漏洞

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki version 1.35.1 and...

Tangro Business Workflow 授权问题漏洞

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A vulnerability exists in Tangro Business Workflow prior to version 1.18.1 due to an authorization issue, which stems from the...

Injection Vulnerabilities

Jenkins is vulnerable to injection vulnerabilities. An attacker is able to exploit a stored XSS vulnerability and control part of the reason a queue item is blocked, such as label expressions not matching any idle executors...

UBUNTU-CVE-2020-27663

In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any itemType e.g., Ticket, Users, etc...

GLPI 安全漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

UBUNTU-CVE-2020-25702

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

PT-2020-22129

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. The crash state involves the functions flb free, flb sds destroy, and flb kv item destroy. No information...

OSV-2020-1965 UNKNOWN READ in asn1_item_print_ctx

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13920 Crash type: UNKNOWN READ Crash state: asn1itemprintctx asn1templateprintctx asn1itemprintctx...

PT-2020-22050

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash occurred due to an unknown read issue. The crash state involves several functions, including asn1 item print ctx and asn1 template print ctx. No...