CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

Cross site scripting

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

CVE-2022-34778

The CVE-2022-34778 entry affects the Jenkins TestNG Results Plugin (554.va4a552116332 and earlier). The vulnerability arises when the plugin renders unescaped test descriptions and exception messages in test results, enabling cross-site scripting (XSS) if an attacker can configure jobs or control...

CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

CVE-2022-34778

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

PT-2022-22329 · Jenkins · Jenkins Testng Results Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TestNG Results Plugin versions 554.va4a552116332 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs when the Jenkins TestNG Results Plugin renders unescaped test descriptions and...

CVE-2022-34778: Improper Neutralization of Input During Web Page Generation

Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs or contro...

Jenkins Plugin TestNG Results 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exis...

XSS vulnerability in testng-plugin

testng-plugin has options in its post-build step configuration to not escape test descriptions and exception messages. If those options are unchecked, testng-plugin 554.va4a552116332 and earlier renders the unescaped text provided in test results. This results in a cross-site scripting XSS...

Man-in-the-Middle (MitM)

testng is vulnerable to man-in-the-middle attacks. The library performs network request over an insecure HTTP channel when loading a DTD, regardless of the Suite.xml declarations. This allows a remote attacker to perform a man-in-the-middle attack to intercept and modify network traffic...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

Unsafe Dependency Resolution

Overview org.testng:testng is a testing framework for the JVM. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious user could have perform a...