Archive
12 January 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 6.9
XSS vulnerability in translations
### Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for…
-
Medium 5.3
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
-
Medium 5.3
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.
-
Medium 5.4
CSRF vulnerability in Jenkins batch task Plugin
Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task.
-
Medium 4.3
Path traversal vulnerability in Jenkins Publish Over SSH Plugin
Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins …
-
Medium 6.5
Missing permission check in Jenkins Publish Over SSH Plugin
A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Medium 4.3CVE-2022-23111 EPSS 27%
CSRF vulnerability and missing permission checks in Jenkins Publish Over SSH Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
-
Medium 4.8
Stored XSS vulnerability in Jenkins Publish Over SSH Plugin
Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
-
Medium 6.5
Improper credentials masking in Jenkins HashiCorp Vault Plugin
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Badge Plugin
Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
-
Medium 4.8
User passwords transmitted in plain text by Jenkins Active Directory Plugin
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
-
Medium 5.5
Access key stored in plain text by Jenkins Metrics Plugin
Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 4.3
Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs
Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin
A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin
Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a …
-
Medium 5.4CVE-2022-20615 EPSS 82%
Stored XSS vulnerability in Matrix Project Plugin
Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
-
Medium 4.3
Cross-Site Request Forgery in Jenkins
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
-
Medium 6.3
TIBCO Data Virtualization Arbitrary File Download vulnerability
The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a lo…
-
Medium 6.7
Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by ano…
-
Medium 5.0
Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File
A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex…
-
Medium 6.1
Cortex XDR Agent: Local Arbitrary File Deletion Vulnerability
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service conditi…
-
Medium 5.4
Cross-site Scripting in django-cms
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the …
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in weseek/growi
growi is vulnerable to Authorization Bypass Through User-Controlled Key
-
Medium 6.3
Missing Authorization in snipe/snipe-it
snipe-it is vulnerable to Missing Authorization
-
Medium 4.3
Cross-Site Request Forgery in Jenkins Mailer Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.
-
Medium 4.3
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.