CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

CVE-2022-27207

CVE-2022-27207 describes a stored XSS vulnerability in the Jenkins global-build-stats Plugin, affecting versions 1.5 and earlier. The issue arises because multiple fields in the chart configuration on the Global Build Stats page are not escaped, enabling an attacker with Overall/Administer permis...

CVE-2022-27207

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

Jenkins global-build-stats Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building and deploying projects. The vulnerability is caused by the plugin's failure to escape multiple fields in the chart configuration...

PT-2022-7507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a NULL pointer dereference in the ice update vsi tx ring stats function, which updates Tx ring stats. This can lead to a denial of service. The problem occurs...

CVE-2022-27207: Improper Neutralization of Input During Web Page Generation

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...

PT-2022-18294 · Jenkins · Jenkins Global-Build-Stats Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins global-build-stats Plugin versions 1.5 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because multiple fields in the chart configuration on the 'Global Build Stats' page are...

Stored XSS vulnerability in global-build-stats

global-build-stats 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission. As of publication of this advisory, there is...

PT-2022-5912 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.16-rc6 Description: An issue in the Linux kernel is related to a null pointer dereference in the netvsc get ethtool stats function in drivers/net/hyperv/netvsc drv.c. This occurs due to a lack of check of the...

ALSA-2022:0825 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel 4.18.0. BZ2036888 Security Fixes: kernel: improper initialization of the "flags" member of the new pipebuffer CVE-2022-0847 kernel: U...

PT-2022-37867

Уязвимость функции f2fs build stats модуля fs/f2fs/debug.c файловой системы F2FS ядра операционной системы Linux связана с ошибками управления состоянием. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

WordPress Global Income Stats from Freemius plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Global Income Stats from Freemius plugin versions = 1.0.0. Solution No patched version available...

CVE-2021-39619

In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

ansible-role-chrony (>=1.0.3, <=1.3.0), hive-builder (>=2.2.0, <=2.3.1) +3 more potentially affected by CVE-2020-14332 via ansible (>=2.10.0rc1, <=2.10.0)

ansible PYPI version =2.10.0rc1, =1.0.3, =2.2.0, =0.0.1, =0.0.29, =0.0.31 Source cves: CVE-2020-14332 Source advisory: GHSA-J667-C2HM-F2WP...

ansible-role-chrony (>=1.0.3, <=1.3.0), hive-builder (>=2.2.0, <=2.3.1) +3 more potentially affected by CVE-2020-14332 via ansible (>=2.10.0rc1, <=2.10.0)

ansible PYPI version =2.10.0rc1, =1.0.3, =2.2.0, =0.0.1, =0.0.29, =0.0.31 Source cves: CVE-2020-14332 Source advisory: OSV:GHSA-J667-C2HM-F2WP...

PT-2022-7535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the bnx2fc recv frame function in the Linux kernel, which modifies the per cpu lport stats counters in a non-mpsafe way. This can lead to a bug when using...

Denial of service in sidekiq

In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users...

Denial of service in sidekiq

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users...

Denial Of Service (DoS)

sidekiq is vulnerable to denial of service. The library does not properly validate the days parameter when requesting stats for the graph, allowing an attacker to cause an application crash...

CVE-2022-23837

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users...