Archive
16 May 2023
Vulnerabilities first published on this day (UTC), newest first.
95 results · Feed
-
Medium 6.5
Jenkins Azure VM Agents Plugin missing permission checks
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another …
-
High 8.8
Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
-
Medium 4.3
Jenkins Azure VM Agents Plugin missing permission checks
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
High 8.8
Jenkins Reverse Proxy Auth Plugin cross-site request forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
-
High 8.8CVE-2023-32986 EPSS 61%
Jenkins File Parameter Plugin arbitrary file write vulnerability
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins contr…
-
Medium 4.3CVE-2023-32985 EPSS 72%
Jenkins Sidebar Link Plugin vulnerable to Path Traversal
Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller…
-
Medium 5.3
Jenkins Ansible Plugin job configuration form does not mask variables
Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them.
-
Medium 5.4
Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability
Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl…
-
Medium 4.3
Jenkins Ansible Plugin stores and displays secrets in plain text
Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
-
High 8.8
Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
-
Medium 4.3
Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
-
Medium 4.3
Jenkins Email Extension Plugin missing permission check
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on…
-
Medium 4.3
Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
-
Medium 5.4
Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.
-
Medium 4.3
Gira HomeServer hslist cross site scripting
A vulnerability classified as problematic was found in Gira HomeServer up to 4.12.0.220829 beta. This vulnerability affects unknown code of the file /hslist. The manipulation of the argument lst with the input debug%27"><img%20src=x%20onerror=alert(document.c…
-
Medium 5.9
CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthentica…
-
Medium 6.3
Tongda OA GatewayController.php actionGetdata unrestricted upload
A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has…
-
High 7.1
WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.
-
Unscored —
crate has been renamed to `crypto_secretbox`
This crate has been forked/renamed from `xsalsa20poly1305` to `crypto_secretbox`. The new repository location is at: <https://github.com/RustCrypto/nacl-compat/tree/master/crypto_secretbox>
-
Medium 6.5
WordPress Arconix Shortcodes Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Arconix Shortcodes plugin <= 2.1.7 versions.
-
Medium 6.5
WordPress WPJAM Basic Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Denis WPJAM Basic plugin <= 6.2.1 versions.
-
Medium 5.9
WordPress Verified Reviews (Avis Vérifiés) Plugin <= 2.3.13 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions.
-
Medium 6.5
WordPress Mail Subscribe List Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Richard Leishman t/a Webforward Mail Subscribe List plugin <= 2.1.9 versions.
-
Medium 6.5
WordPress Uji Popup Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPmanage Uji Popup plugin <= 1.4.3 versions.
-
Medium 5.9
WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Formilla Live Chat by Formilla plugin <= 1.3 versions.
-
Medium 6.6
RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access syst…
-
Critical 9.8
RegistrationMagic <= 5.2.1.0 - Authentication Bypass
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it pos…
-
Medium 6.5
WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bruno "Aesqe" Babic File Gallery plugin <= 1.8.5.3 versions.
-
Medium 5.9
WordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Harish Chouhan, Themeist I Recommend This plugin <= 3.8.3 versions.
-
Critical 9.8
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI compone…
-
High 8.1
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client…
-
Medium 5.0
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized rea…
-
Medium 6.1
video carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scripting
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possi…
-
Medium 6.1
Video Gallery <= 1.0.10 - Reflected Cross-Site Scripting
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthentica…
-
Medium 4.3
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileg…
-
Critical 9.8
D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,
-
Critical 9.8
Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac paramet…
-
High 8.8
An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileg…
-
High 8.8
An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafte…
-
High 7.5
Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of …