CVE-2025-12634 Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress plugin Callback Request 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Callback Request plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Callback Request versions = 1.4...

CVE-2023-41937

CVE-2023-41937 affects the Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0–2.8.3 (inclusive). The vulnerability arises because the plugin trusts values in the webhook payload (including certain URLs) and uses configured Bitbucket credentials to connect to those URLs, enabling an att...

CVE-2023-41937

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...

PT-2023-28175

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions 2.4.0 through 2.8.3 Description The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin...

CVE-2023-41937: Server-Side Request Forgery (SSRF)

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...

WordPress Plugin Cancel order request WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

org.jenkins-ci.plugins:github-pullrequest (>=0.0.1-beta7, <=0.0.1-beta12) potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (2.2.12)

org.jenkins-ci.plugins:git MAVEN version 2.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-pullrequest =0.0.1-beta7, =0.0.1-beta12 Source cves: CVE-2022-36882 Source...

GHSA-2QH6-HHVV-M2WW Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file jenkins.plugins.httprequest.HttpRequest.xml on the Jenkins controller as part of its configuration when using deprecated Basic/Digest Authentication. These passwords can be viewed by...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-36901: Insufficiently Protected Credentials

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

PT-2022-4019 · Jenkins · Jenkins Http Request Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTTP Request Plugin versions 1.15 and earlier Description: The issue is related to the storage of HTTP Request passwords in an unencrypted form in the global configuration file on the Jenkins controller. This allows users with access ...

CVE-2013-4944

The CVE-2013-4944 issue affects the WordPress plugin BuddyPress Extended Friendship Request (versions before 1.0.2). When the Friend Connections component is enabled, an XSS flaw exists in the friendship_request_message parameter passed to wp-admin/admin-ajax.php, enabling remote script/HTML inje...