Category
Web / CMS
26,784 known vulnerabilities.
840 results · Clear filters · Feed
-
Low 3.4
WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
-
Low 3.4
WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
-
Low 2.4
A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 …
-
Low 3.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions star…
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions star…
-
Low 3.1
Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting …
-
Low 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a D…
-
Low 3.5
An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trig…
-
Low 3.1
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since r…
-
Low 3.1
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting f…
-
Low 3.4
WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
-
Low 3.3
Client Secret stored in plain text by Jenkins GitLab Authentication Plugin
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Sensitive parameter values captured in build metadata files by Jenkins Parameterized Trigger Plugin
Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted an…
-
Low 3.7
WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
-
Low 2.6
Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
-
Low 3.1
Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path…
-
Low 3.4CVE-2021-23174 EPSS 84%
WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
-
Low 3.8
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessin…
-
Low 3.5
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
Low 3.5
Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and…
-
Low 3.3
Password stored in plain text by Jenkins Publish Over SSH Plugin
Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.7
Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
-
Low 3.4
WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
-
Low 3.7
An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 all…
-
Low 3.1
A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14…
-
Low 3.5
Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting …
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions star…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions st…
-
Low 3.1
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting fro…
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions star…
-
Low 3.1
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 …
-
Low 3.7
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may a…
-
Low 1.7
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting…
-
Low 2.7
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiti…
-
Low 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a proj…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
Low 3.5
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client appl…
-
Low 2.6
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starti…
-
Low 2.9
In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s passwo…
-
Low 2.0
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in …