Archive
15 March 2022
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 5.3
Path Traversal in Gitea
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
-
Medium —
Sysctls applied to containers with host IPC or host network namespaces can affect the host
### Impact Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o…
-
Medium 4.3
IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow a…
-
Medium 4.3
Personal tokens stored in plain text by Jenkins incapptic connect uploader Plugin
Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
-
Medium 4.3
Passwords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin
Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
-
Medium 6.5
Passwords stored in plain text by Jenkins dbCharts Plugin
Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
-
Medium 4.3
Missing permission checks in Jenkins Release Helper Plugin
A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 4.3
CSRF vulnerability in Jenkins Release Helper Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 5.4
Stored Cross-site Scripting vulnerability in Jenkins List Git Branches Parameter Plugin
Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
-
Medium 4.3
Missing permission checks in Jenkins kubernetes-cd Plugin allow enumerating credentials IDs
A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.5
Arbitrary file read vulnerability in Jenkins kubernetes-cd Plugin
Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller.
-
Medium 4.8
Stored Cross-site Scripting vulnerability in Jenkins global-build-stats Plugin
Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer perm…
-
Medium 4.3
CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF
A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
-
Medium 4.3
CSRF vulnerability and missing permission checks in Jenkins Extended Choice Parameter Plugin allow SSRF
A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL.
-
Medium 6.5
Arbitrary JSON and property file read vulnerability in Jenkins Extended Choice Parameter Plugin
Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.
-
Medium 6.8
Stored Cross-site Scripting in folder-auth plugin
Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
-
Medium 4.3
Missing permission checks in AWS Credentials Plugin
A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
-
Medium 5.4
Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
-
Medium 5.4
Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
-
Medium 6.4
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
-
Medium 6.9CVE-2022-0967 Public exploit
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
-
Medium 5.7CVE-2022-0963 Scanner template
Unrestricted XML Files Leads to Stored XSS in microweber/microweber
Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
-
Medium 6.8CVE-2022-0954 Scanner template
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
-
Medium 6.5
Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
-
Medium 6.1
XML External Entities Vulnerability in CVRF-CSAF-Converter
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the conve…