PT-2022-30660

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-30072

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.33 Description The issue is related to the gcc-plugins/stackleak, where strings are not exactly matched, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not y...

PT-2022-29757

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to the gcc-plugins/stackleak, where strings are not exactly matched, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not y...

PT-2022-30330

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.110 Description The issue concerns the gcc-plugins/stackleak, where strings are not exactly matched, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not yet...

PT-2022-30497

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.189 Description The issue is related to the gcc-plugins/stackleak, where strings are not exactly matched, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not y...

PT-2022-29437

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description The issue is related to the gcc-plugins/stackleak, where strings are not exactly matched, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not ye...

PT-2022-30567

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.239 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixe...

Remote Code Execution (RCE)

jenkins-2-plugins is vulnerable to remote code execution. The vulnerability exists due to a sandbox bypass allowing an attacker to inject maliciously crafted code into the system...

Privilege Escalation

jenkins-2-plugins is vulnerable to privilege escalation. The vulnerability exists due to a lack of sanitization of the path allowing an attacker to configure Pipelines permission to read arbitrary files on the Jenkins controller file system...

OS Command Injection

jenkins-2-plugins is vulnerable to OS command injection. The vulnerability exists due to a lack of sanitization for distinct SCMs for the readTrusted step allowing an attacker with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...

CVE-2022-1384

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...

CVE-2021-25120

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues...

CVE-2021-25120

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues...

Format string

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop...

Jenkins Subversion Plugin Cross-Site Request Forgery Vulnerability

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Subversion Plugin is vulnerable to cross-site request forgery, which can be exploited by an attacker to connect to ...

Multiple Plugins from Cool Plugins - Subscriber+ Arbitrary Plugin Installation & Activation

Multiple plugins from the Cool Plugins vendor are missing capability and proper CSRF check in the coolpluginsinstall and coolpluginsactivate AJAX actions, available to any authenticated users, allowing them to install and activate arbitrary plugins via an archive hosted on a remote server they...

WordPress plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2022-0919

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...

CVE-2022-0920

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data...

CVE-2022-0920

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data...