CVE-2024-25304

The CVE-2024-25304 affects Code-projects Simple School Management System 1.0, where an SQL Injection flaw exists in the School/index.php entry point via the 'apass' parameter. The root cause is lack of input validation for this parameter, enabling attackers to manipulate queries and potentially a...

PT-2024-20880 · Code Projects · Code-Projects Simple School Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Simple School Managment System version 1.0 Description: The issue allows SQL Injection via the id parameter at the "School/delete.php?id=5" endpoint. This means an attacker could potentially inject malicious SQL code by...

CVE-2024-25313

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacherlogin.php...

007-nodejs (>=2.5.0 <=2.5.3), 10by10-react-app (=1.2.1) +5570 more potentially affected by CVE-2023-42282 via ip (>=0.0.1 <=1.1.8)

ip NPM version =0.0.1, =2.5.0, =1.0.0, =4.11.0, =1.0.1-5.4, =3.16.2, =3.0.0-beta.22, =3.0.0-beta.22, =3.16.2, =3.16.3, =3.16.2, =3.16.2, =3.0.0-beta.22, =3.16.10 and more Source cves: CVE-2023-42282 Source advisory: OSV:GHSA-78XJ-CGH5-2H22...

The vulnerability of the Jenkins GitLab Branch Source Plugin, related to access control deficiencies, allows attackers to configure and jointly use arbitrary projects.

The vulnerability of the Jenkins GitLab Branch Source Plugin is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to configure and jointly use arbitrary projects...

Raven - CI/CD Security Analyzer

RAVEN Risk Analysis andVulnerability Enumeration for CI/CD is a powerful security tool designed to perform massive scans for GitHub Actions CI workflows and digest the discovered data into a Neo4j database. Developed and maintained by the Cycode research team. With Raven, we were able to identify...

GHSA-FW9H-CXX9-GFQ3 Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

GitLab allows sharing a project with another group. Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group. This allows attackers to configure and share a project, resulting in a crafted Pipeline being...

Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

GitLab allows sharing a project with another group. Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group. This allows attackers to configure and share a project, resulting in a crafted Pipeline being...

CVE-2024-23901

Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group...

CVE-2024-23901

Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

Code injection

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

PT-2024-1424 · Jenkins +1 · Jenkins Gitlab Branch Source Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier Description: The issue is related to insufficient access control in the Jenkins GitLab Branch Source Plugin. This allows attackers to configure and share a project,...

RustProject (=0.1.0), SOEM-sys (=0.2.0) +2132 more potentially affected by CVE-2024-58266 via shlex (>=0.1.1 <=1.1.0)

shlex CARGO version =0.1.1, =0.1.0, =0.1.0, =0.0.9, =0.0.13 - aigcapi =5.1.2 - aigcchain =5.1.2 - aigcconfig =5.1.2 and more Source cves: CVE-2024-58266 Source advisory: OSV:GHSA-R7QV-8R2H-PG27...

CVE-2024-0722

A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cross site scripting. The attack may be...

Cross site scripting

A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cross site scripting. The attack may be...

CVE-2024-0722 code-projects Social Networking Site Message Page message.php cross site scripting

A vulnerability was found in code-projects Social Networking Site 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file message.php of the component Message Page. The manipulation of the argument Story leads to cross site scripting. The attack may be...

PT-2024-15781 · Unknown · Code-Projects Social Networking Site

Name of the Vulnerable Software and Affected Versions: code-projects Social Networking Site version 1.0 Description: A vulnerability was found in the code-projects Social Networking Site, affecting some unknown functionality of the file message.php of the component Message Page. The manipulation ...

GHSA-XGFM-FJX6-62MJ readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Impact This vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the advisory...