Ecosystem
Maven
7,126 known vulnerabilities.
Most affected packages
3,448 results · Clear filters · Feed
-
Medium 4.3
Missing permission check in Jenkins Pipeline Maven Integration Plugin allows enumerating credentials IDs
A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 5.4CVE-2020-2231 Public exploit
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission…
-
Medium 6.5
Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboa…
-
Medium 6.5
Wildfly EJB Client causes DoS
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and…
-
Medium 6.1
Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in…
-
Medium 6.5CVE-2019-14900 Public exploit
SQL Injection in Hibernate ORM
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw c…
-
Medium 6.4
Stored XSS vulnerability in Jenkins Link Column Plugin
Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
-
Medium 6.1
Reflected XSS in Jenkins Compatibility Action Storage Plugin
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
-
Medium 4.3
Missing permission checks in Zephyr for JIRA Test Management Plugin
A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.
-
Medium 5.4
Content-Security-Policy protection for user content disabled by Jenkins ZAP Pipeline Plugin
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
-
Medium 4.3
CSRF vulnerability in Jenkins Zephyr for JIRA Test Management Plugin
A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password.
-
Medium 4.3
Credentials stored in plain text by Jenkins White Source Plugin
Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission (config.xml), or access to the mas…
-
Medium 4.3
Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin
Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration.
-
Medium 4.3
Password stored in plain text by Jenkins TestComplete support Plugin
Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 6.1
Reflected XSS vulnerability in Jenkins VncViewer Plugin
Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
-
Medium 4.3
Secret stored in plain text by Jenkins Slack Upload Plugin
Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
-
Medium 5.4
Missing permission checks in Jenkins Fortify on Demand Plugin
A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.
-
Medium 6.1
Reflected XSS vulnerability in Jenkins VncRecorder Plugin
Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
-
Medium 4.8
Stored XSS vulnerability in Jenkins VncRecorder Plugin
Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators.
-
Medium 5.4
CSRF vulnerability in Jenkins Fortify on Demand Plugin
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.
-
Medium 4.3
Users with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin
A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin
Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability.
-
Medium 5.5
ActiveMQ Artemis has Insufficiently Protected Credentials
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local …
-
Medium 6.6
Wildfly Unsafe Deserialization Vulnerability
A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
-
Medium 5.3CVE-2020-9495 Public exploit
Injection in Apache Archiva
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LD…
-
Medium 6.3
Server-Side Request Forgery in Karaf
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In…
-
Medium 6.5
Liferay Portal and Liferay DXP Fails to Sanitize API Data
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to…
-
Medium 6.1CVE-2020-13973 Public exploit
Cross-site scripting in json-sanitizer
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where…
-
Medium 4.3
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.
-
Medium 6.1
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
-
Medium 4.3
Missing permission check in Jenkins Project Inheritance Plugin
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.
-
Medium 5.4
Stored XSS vulnerability in Jenkins Compact Columns Plugin
Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
-
Medium 5.4
Stored XSS vulnerability in Jenkins ECharts API Plugin
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
-
Medium 5.4
Stored XSS vulnerability in Jenkins ECharts API Plugin
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
-
Medium 5.4
CSRF vulnerability in Jenkins Swarm Plugin
A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.
-
Medium 5.4
Improper permission checks in Jenkins Swarm Plugin
Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels.
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
-
Medium 6.5
HTTP Request Smuggling in Undertow
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
-
Medium 6.1CVE-2020-7656 Public exploit
Cross-Site Scripting in jquery
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
-
Medium 5.3
Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.