Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
1,521 results · Feed
-
Medium 4.3
Missing Authorization in Jenkins S3 publisher Plugin
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles.
-
Medium 5.4CVE-2021-21649 EPSS 73%
Cross-site Scripting in Jenkins Dashboard View Plugin
Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
-
Medium 4.3
Missing Authorization in Jenkins S3 publisher Plugin
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Ar…
-
Medium 6.1CVE-2021-21648 EPSS 11%
Cross-Site Request Forgery in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
-
Unscored —CVE-2021-31537 Scanner template
SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, …
-
Medium 6.1
OctoPrint API Error Messages vulnerable to XSS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.
-
Medium 6.5
OctoPrint Incorrect Access Control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.
-
Unscored —
VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5.
-
Unscored —
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.
-
Unscored —
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.
-
Unscored —
In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
-
Unscored —
In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchan…
-
Unscored —
In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.
-
Unscored —
In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.
-
Unscored —
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary…
-
Unscored —
In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.
-
Unscored —
In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.
-
Unscored —CVE-2021-30005 Public exploit
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the…
-
Unscored —
In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.
-
Unscored —
In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.
-
Unscored —
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.
-
Unscored —
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
-
Unscored —
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.
-
Unscored —
In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.
-
Unscored —
In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the …
-
Unscored —
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
-
Unscored —
In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.
-
Unscored —
In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-o…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. Th…