CVE Vulnerability Catalog

A critical vulnerability was found in Boss Mini 1.4.0 Build 6221, affecting an unknown part of the file boss/servlet/document. Manipulation of the argument path leads to file inclusion.

A vulnerability was found in GZ Scripts Vacation Rental Website 1.8, affecting some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ in the HTTP POST Request Handler component. Manipulation of the arguments username/title/comment leads to cross-site scripting.

A vulnerability has been found in NodCMS 3.4.1 affecting an unknown functionality of the file /en/blog-comment-4 in the POST Request Handler component. Manipulation of the arguments comment_name/comment_content leads to cross site scripting.

A vulnerability exists in Palo Alto Networks PAN-OS software that allows an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

Online Piggery Management System version 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to 'manage-breed.php', resulting in Persistent XSS.

Online Piggery Management System version 1.0 is vulnerable to File Upload. An unauthenticated user can upload a PHP file by sending a POST request to 'add-pig.php.'

Online Piggery Management System version 1.0 is vulnerable to SQL Injection, which may lead to unauthorized access to the database.

A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

The Jenkins ElasticBox CI Plugin version 5.0.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

The Jenkins Benchmark Evaluator Plugin version 1.0.1 and earlier has a CSRF vulnerability that allows attackers to connect to an attacker-specified URL and check for the existence of directories and `.csv` and `.ycsb` files on the Jenkins controller file system.

The Assembla Auth plugin in Jenkins version 1.14 and earlier contains a CSRF vulnerability that allows attackers to trick users into logging into the attacker's account.

The MathWorks Polyspace Plugin for Jenkins version 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.

A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

The Sumologic Publisher plugin in Jenkins version 2.2.1 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL.

The Jenkins Pipeline restFul API Plugin version 0.11 and earlier has a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token.

A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

The Jenkins Test Results Aggregator Plugin version 1.2.13 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

The Rebuilder plugin in Jenkins version 320.v5a_0933a_e7d61 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to rebuild a previous build.

A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.