Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the printtestresult function in /admin/install.php. An attacker can inject malicious HTML or scripts by supplying crafted parameters, leading to credential phishing...

EUVD-2021-21707

Malware in sbrugna...

EUVD-2022-5890

Malicious code in bioql PyPI...

EUVD-2022-5753

Malicious code in bioql PyPI...

CVE-2022-34181

Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller ...

Malicious code in publish-test-result-screenshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf2cd13f851593ee5dc61c5c17c22a1efa0d43ec11f32023e7dfecfdd1c76adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in publish-test-result-screenshot

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in test-result-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be46efd7d71b6494d55cf52ec783c591c2bfe3524cdfcc6a9d17ed75abb8d492 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in test-result-logger

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1525 Malicious code in test-result-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be46efd7d71b6494d55cf52ec783c591c2bfe3524cdfcc6a9d17ed75abb8d492 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TestComplete support Plugin vulnerable to stored Cross-site Scripting

TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name in its test result page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

GHSA-7P6G-GR9G-VFX6 Jenkins LoadComplete support Plugin Cross-site Scripting vulnerability

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name in its test result page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

GHSA-5WPG-QCMJ-48WH TestComplete support Plugin vulnerable to stored Cross-site Scripting

TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name in its test result page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

PT-2023-24137

Name of the Vulnerable Software and Affected Versions Jenkins LoadComplete support Plugin versions 1.0 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the LoadComplete test name is not properly escaped, allowing attackers with...

PT-2023-24133

Name of the Vulnerable Software and Affected Versions Jenkins TestComplete support Plugin versions 2.8.1 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the TestComplete project name is not properly escaped, allowing attackers...

Stored XSS vulnerability in TestComplete

TestComplete 2.8.1 and earlier does not escape the TestComplete project name in its test result page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce...

Unnecessary precision loss in redeemKIBT()

Lines of code Vulnerability details Impact Unnecessary precision loss in redeemKIBT Proof of Concept If enter Deprecated mode, user can switch back to StableCoin by percentage with redeemKIBT The redeemKIBT implementation code is as follows: function redeemKIBTuint256 amount external override...

Stored XSS vulnerability in junit

junit 1119.vaa5e9068dad7 and earlier does not escape descriptions of test results. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Run/Update permission. junit 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test...

PT-2022-22043 · Jenkins · Jenkins Junit Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JUnit Plugin versions 1119.va a 5e9068da d7 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because descriptions of test results are not properly escaped. This vulnerability is exploitable...

Jenkins JUnit Plugin CSRF vulnerability

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...