CVE Vulnerability Catalog

The Favorite View plugin in Jenkins versions 5.v77a_37f62782d and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to add or remove views from another user's favorite views tab bar.

Jenkins Docker Swarm Plugin version 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, leading to a stored XSS vulnerability.

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.

The webhook endpoint in Jenkins Gogs Plugin version 1.0.15 and earlier exposes unauthenticated attackers to information about the existence of jobs in its output.

The Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin version 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access credentials they are not entitled to.

Jenkins Shortcut Job Plugin version 0.4 and earlier does not escape the shortcut redirection URL, leading to a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers able to configure shortcut jobs.

The Delphix Plugin for Jenkins version 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access credentials they are not entitled to.

A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

The Tuleap Authentication Plugin for Jenkins version 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token. This allows attackers to use statistical methods to obtain a valid authentication token.

Jenkins Flaky Test Handler Plugin version 1.2.2 and earlier does not escape JUnit test contents when displayed on the Jenkins UI, leading to a stored XSS vulnerability.

Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available.

The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy a view inside a folder.

A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function.

In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an unverified password change, which may lead to unauthorized access.

The 'Rikunabi NEXT' app for Android prior to version 11.5.0 has improper authorization in the custom URL scheme handler, allowing a malicious intent to direct the app to access an arbitrary website.

The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to and including 1.2.11. This allows authenticated attackers with subscriber privileges or above to view logs.

Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.

The Broadcom RAID Controller web interface does not enforce SSL cipher ordering by the server, potentially leading to security vulnerabilities.

The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.

The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.