CVE Vulnerability Catalog

The Tuleap Authentication Plugin for Jenkins version 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token. This allows attackers to use statistical methods to obtain a valid authentication token.

Jenkins Flaky Test Handler Plugin version 1.2.2 and earlier does not escape JUnit test contents when displayed on the Jenkins UI, leading to a stored XSS vulnerability.

The Jenkins Blue Ocean Plugin version 1.27.5 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

Jenkins NodeJS Plugin version 1.6.0 and earlier does not properly mask credentials specified in the Npm config file in Pipeline build logs, which may lead to the exposure of sensitive data.

Jenkins Config File Provider Plugin version 952.va_544a_6234b_46 and earlier does not mask credentials specified in configuration files when they're written to the build log.

Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available.

The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy a view inside a folder.

The Jenkins Folders Plugin version 6.846.v23698686f0f6 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to copy folders.

In MIT Kerberos 5 (krb5) version 1.21 before 1.21.2, there is a double free vulnerability that can be triggered by an authenticated user if an authorization-data handling failure occurs. Incorrect data is copied from one ticket to another.

The Campcodes Online Matrimonial Website System Script 3.3 has an XSS vulnerability that can be exploited via a crafted SVG document in the upload module.

A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function.

The 'Customization fields fee for your store' (aicustomfee) module in the ai-dev module for PrestaShop is vulnerable to SQL injection up to version 0.2.0. Version 0.2.1 has fixed this security issue.

Dell PowerScale OneFS w wersjach 8.2.x-9.5.x zawiera podatność na ujawnienie wrażliwych informacji osobom nieuprawnionym. Autoryzowany lokalny atakujący może potencjalnie wykorzystać tę podatność, co może prowadzić do eskalacji uprawnień.

Dell PowerScale OneFS w wersji 9.5.0.x zawiera lukę umożliwiającą obejście mechanizmu ochrony. Zdalny atakujący bez uprawnień może wykorzystać tę lukę, co może prowadzić do odmowy usługi, ujawnienia informacji oraz zdalnego wykonania kodu.

Dell PowerScale OneFS w wersjach 8.2.x - 9.5.0.x zawiera podatność na podniesienie uprawnień. Atakujący z niskimi uprawnieniami lokalnymi może wykorzystać tę podatność, co może prowadzić do odmowy usługi, wykonania kodu oraz ujawnienia informacji.

A Directory Traversal vulnerability in the Server functionality of Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary code.

In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an unverified password change, which may lead to unauthorized access.

Wtyczka YARPP dla WordPressa w wersjach przed 5.30.3 nie waliduje i nie ucieka niektórych atrybutów shortcode przed ich użyciem w zapytaniach SQL, co może umożliwić uwierzytelnionym użytkownikom, takim jak subskrybenci, przeprowadzenie ataków SQL Injection.

The lol-html library can cause panics when processing certain HTML inputs. Anyone processing arbitrary third-party HTML with the library is affected.

The 'Rikunabi NEXT' app for Android prior to version 11.5.0 has improper authorization in the custom URL scheme handler, allowing a malicious intent to direct the app to access an arbitrary website.