28 matches found
EUVD-2022-2778
Malicious code in bioql PyPI...
EUVD-2022-0457
Malicious code in bioql PyPI...
EUVD-2022-3449
Malicious code in bioql PyPI...
EUVD-2022-0518
Malicious code in bioql PyPI...
br.com.ingenieux.jenkins.plugins:codecommit-url-helper (=0.0.1), cf.pgmann.plugins:url-auth-sso (=1.0) +125 more potentially affected by CVE-2018-8718 via org.jenkins-ci.plugins:mailer (>=1.10 <=1.20)
org.jenkins-ci.plugins:mailer MAVEN version =1.10, =1.9.2-beta, =1.14.0, =4.1.1, =2.30.2, =1.0.22, =1.3.0, =0.11.0, =1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2018-8718 Source advisory: OSV:GHSA-6G57-H38C-Q52G...
Cross-Site Request Forgery in Jenkins Mailer Plugin
Cross-site request forgery CSRF vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request...
GHSA-6G57-H38C-Q52G Cross-Site Request Forgery in Jenkins Mailer Plugin
Cross-site request forgery CSRF vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request...
GHSA-9V72-P5P3-9W65 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in ra...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability was found in the Jenkins Mailer plugin. The form validation method does not require POST requests...
GHSA-85RQ-HP8X-GHJQ Cross-Site Request Forgery in Jenkins Mailer Plugin
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20614
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
PT-2022-14823 · Jenkins · Jenkins Mailer Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions 391.ve4a 38c1b cf4b and earlier Jenkins Mailer Plugin versions prior to 408.vd726a 1130320 and 1.34.2 Description: A missing permission check in the Jenkins Mailer Plugin allows attackers with Overall/Read acces...
Jenkins Plugin 跨站请求伪造漏洞
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . A cross-site request forgery vulnerability exists in Jenkins Mailer that stems from the software's lack of validation f...
CVE-2022-20614
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20614
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...