Category

Web / CMS

26,838 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5,621 results · Clear filters · Feed

High 8.0

CVE-2022-34189

Cross-site Scripting in Jenkins Image Tag Parameter Plugin

Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure pe…

Jenkins Project Jenkins Image Tag Parameter Plugin org.jenkins-ci.plugins:image-tag-parameter Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34188

Cross-site Scripting in Jenkins Hidden Parameter Plugin

Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configu…

Jenkins Project Jenkins Hidden Parameter Plugin org.jenkins-ci.plugins:hidden-parameter Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34187

Cross-site Scripting in Jenkins Filesystem List Parameter Plugin

Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers …

Jenkins Project Jenkins Filesystem List Parameter Plugin aendter.jenkins.plugins:filesystem-list-parameter-plugin Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34186

Cross-site Scripting in Jenkins Dynamic Extended Choice Parameter Plugin

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attac…

Jenkins Project Jenkins Dynamic Extended Choice Parameter Plugin com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34185

Cross-site Scripting in Jenkins Date Parameter Plugin

Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Jenkins Project Jenkins Date Parameter Plugin me.leejay.jenkins:date-parameter Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34184

Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

Jenkins Project Jenkins CRX Content Package Deployer Plugin org.jenkins-ci.plugins:crx-content-package-deployer Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34183

Cross-site Scripting in Jenkins Agent Server Parameter Plugin

Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configu…

Jenkins Project Jenkins Agent Server Parameter Plugin io.jenkins.plugins:agent-server-parameter Web / CMS Maven

Jun 22, 2022
High 8.8

CVE-2022-34182

Reflected Cross-site Scripting in Jenkins Nested View Plugin

Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins Nested View Plugin org.jenkins-ci.plugins:nested-view Web / CMS Maven

Jun 22, 2022
High 8.8

CVE-2022-34178

Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins Embeddable Build Status Plugin org.jenkins-ci.plugins:embeddable-build-status Web / CMS Maven

Jun 22, 2022
High 7.5

CVE-2022-34175

Unauthorized view fragment access in Jenkins

Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jun 22, 2022
High 8.0

CVE-2022-34173

Cross-site Scripting vulnerability in Jenkins

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven

Jun 22, 2022
High 8.0

CVE-2022-34172

Cross-site Scripting vulnerability in Jenkins

In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven

Jun 22, 2022
High 8.0

CVE-2022-34171

Cross-site Scripting vulnerability in Jenkins

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven

Jun 22, 2022
High 8.0

CVE-2022-34170

Cross-site Scripting vulnerability in Jenkins

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins Web / CMS Alpine Maven

Jun 22, 2022
High 8.0

CVE-2022-34176 EPSS 78%

Cross-site Scripting in Jenkins JUnit Plugin

Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven

Jun 22, 2022
High 8.8

CVE-2022-34177

Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside …

Jenkins Project Jenkins Pipeline: Input Step Plugin org.jenkins-ci.plugins:pipeline-input-step Web / CMS Maven

Jun 22, 2022
High 8.8

CVE-2022-1969

Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unau…

scriptcoil Mobile browser color select Web / CMS

Jun 13, 2022
High 8.8

CVE-2022-1749

WPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbi…

createplugin WPMK Ajax Finder Web / CMS

Jun 13, 2022
High 8.8

CVE-2022-1900

Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting

The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins…

robmcvey Copify Web / CMS

Jun 13, 2022
High 8.8

CVE-2022-1918

ToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting

The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to u…

miguelo2008 ToolBar to Share Web / CMS

Jun 13, 2022
High 7.7

CVE-2022-1940

A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to…

GitLab GitLab Web / CMS

Jun 6, 2022
High 7.1

CVE-2022-1423

Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before …

GitLab GitLab Web / CMS

May 19, 2022
High 8.8

CVE-2022-29429

WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerability

Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.

Alexander Stokmann Code Snippets Extended (WordPress plugin) Web / CMS

May 17, 2022
High 7.1

CVE-2022-30972

Cross Site Request Forgery in Jenkins Storable Configs Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins cont…

Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven

May 17, 2022
High 7.1

CVE-2022-30971

XML External Entity Reference in Jenkins Storable Configs Plugin

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Storable Configs Plugin org.jvnet.hudson.plugins:storable-configs-plugin Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30970

Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulner…

Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven

May 17, 2022
High 8.8

CVE-2022-30969

Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30968

Cross-site Scripting in Jenkins vboxwrapper Plugin

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Jenkins Project Jenkins vboxwrapper Plugin org.jenkins-ci.plugins:vboxwrapper Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30967

Cross site scripting in Jenkins Selection tasks Plugin

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with I…

Jenkins Project Jenkins Selection tasks Plugin org.jvnet.hudson.plugins:selection-tasks-plugin Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30965

Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Co…

Jenkins Project Jenkins Promoted Builds (Simple) Plugin org.jenkins-ci.plugins:promoted-builds-simple Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30964

Cross-site Scripting in Jenkins Multiselect parameter Plugin

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure…

Jenkins Project Jenkins Multiselect parameter Plugin io.jenkins.plugins:multiselect-parameter Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30963

Cross-site Scripting in Jenkins JDK Parameter Plugin

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Jenkins Project Jenkins JDK Parameter Plugin org.jenkins-ci.plugins:JDK_Parameter_Plugin Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30962

Cross-site Scripting in Jenkins Global Variable String Parameter Plugin

Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke…

Jenkins Project Jenkins Global Variable String Parameter Plugin org.jenkins-ci.plugins:global-variable-string-parameter Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30961

Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers…

Jenkins Project Jenkins Autocomplete Parameter Plugin org.jenkins-ci.plugins:autocomplete-parameter Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30960

Cross-site Scripting in Jenkins Application Detector Plugin

Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure …

Jenkins Project Jenkins Application Detector Plugin org.jenkins-ci.plugins:app-detector Web / CMS Maven

May 17, 2022
High 7.1

CVE-2022-30959

Missing Authorization in Jenkins SSH plugin

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials sto…

Jenkins Project Jenkins SSH Plugin org.jenkins-ci.plugins:ssh Web / CMS Maven

May 17, 2022
High 7.1

CVE-2022-30958

Cross Site Request Forgery in Jenkins SSH Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in…

Jenkins Project Jenkins SSH Plugin org.jenkins-ci.plugins:ssh Web / CMS Maven

May 17, 2022
High 8.0

CVE-2022-30956 EPSS 73%

Cross-site Scripting in Jenkins Rundeck Plugin

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.

Jenkins Project Jenkins Rundeck Plugin org.jenkins-ci.plugins:rundeck Web / CMS Maven

May 17, 2022
High 7.5

CVE-2022-30947

Path traversal in Jenkins Git Mercurial and Repo Plugins

Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM content…

Jenkins Project Jenkins Git Plugin git org.jenkins-ci.plugins:git Web / CMS Azure Linux Maven

May 17, 2022
High 7.5

CVE-2022-30945

Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.

Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven

May 17, 2022