WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2022-06-30✕
Overview 4,530 matches · 339 protected · 34 exploited · 2 CISA KEV · 204 public PoC · 84 EPSS ≥ 0.5
4,530matches 339protected7.5% 34exploited0.8% 2CISA KEV0.0% 204public PoC4.5% 84EPSS ≥ 0.51.9%
Protected by Waratek 340 7.5% Rule in development 0 0.0% Mitigation candidate 161 3.6% No exploit published 4,029 88.9%
Critical 0 0.0% High 0 0.0% Medium 4,530 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 339 7.5% partly blocked 1 0.0% not blocked 4,187 92.4% not established 3 0.1% unrecorded 0 0.0%
Exploited 34 0.8% Working exploit published 172 3.8% Proof of concept only 21 0.5% Forecast only 27 0.6% No public exploit 4,276 94.4%
split by peak 546 / year
No exploit published: 4,029Mitigation candidate: 161Protected by Waratek: 340 Medium: 4,530 not established: 3not blocked: 4,187partly blocked: 1blocked by ARMR today: 339 No public exploit: 4,276Forecast only: 27Proof of concept only: 21Working exploit published: 172Exploited: 34
20007 Mitigation candidate4 No exploit published3 Medium7 not blocked7 Working exploit published4 No public exploit3 20016 Mitigation candidate2 No exploit published4 Medium6 not blocked6 Working exploit published2 No public exploit4 200223 Protected by Waratek2 Mitigation candidate6 No exploit published15 Medium23 blocked by ARMR today2 not blocked21 Working exploit published6 Forecast only1 No public exploit16 200324 Protected by Waratek2 Mitigation candidate4 No exploit published18 Medium24 blocked by ARMR today2 not blocked22 Working exploit published5 No public exploit19 200418 Protected by Waratek1 Mitigation candidate1 No exploit published16 Medium18 blocked by ARMR today1 not blocked17 Working exploit published1 No public exploit17 200546 Protected by Waratek3 Mitigation candidate4 No exploit published39 Medium46 blocked by ARMR today3 not blocked43 Working exploit published5 No public exploit41 200656 Protected by Waratek4 Mitigation candidate4 No exploit published48 Medium56 blocked by ARMR today4 not blocked52 Working exploit published5 No public exploit51 200771 Protected by Waratek2 Mitigation candidate9 No exploit published60 Medium71 blocked by ARMR today2 not blocked69 Working exploit published9 No public exploit62 200883 Protected by Waratek4 Mitigation candidate8 No exploit published71 Medium83 blocked by ARMR today4 not blocked79 Exploited1 Working exploit published11 No public exploit71 2009129 Protected by Waratek5 Mitigation candidate9 No exploit published115 Medium129 blocked by ARMR today5 not blocked124 Working exploit published11 No public exploit118 2010133 Protected by Waratek6 Mitigation candidate9 No exploit published118 Medium133 blocked by ARMR today6 not blocked127 Exploited2 Working exploit published11 Forecast only1 No public exploit119 2011139 Protected by Waratek4 Mitigation candidate3 No exploit published132 Medium139 blocked by ARMR today4 not blocked135 Working exploit published4 Proof of concept only1 No public exploit134 2012199 Protected by Waratek5 Mitigation candidate17 No exploit published177 Medium199 blocked by ARMR today5 not blocked193 not established1 Exploited4 Working exploit published14 No public exploit181 2013249 Protected by Waratek12 Mitigation candidate12 No exploit published225 Medium249 blocked by ARMR today12 not blocked236 not established1 Exploited3 Working exploit published13 Forecast only1 No public exploit232 2014256 Protected by Waratek32 Mitigation candidate9 No exploit published215 Medium256 blocked by ARMR today32 not blocked224 Exploited1 Working exploit published11 Proof of concept only1 Forecast only2 No public exploit241 2015226 Protected by Waratek20 Mitigation candidate1 No exploit published205 Medium226 blocked by ARMR today20 not blocked206 Exploited2 Working exploit published3 No public exploit221 2016321 Protected by Waratek25 Mitigation candidate4 No exploit published292 Medium321 blocked by ARMR today25 not blocked295 not established1 Exploited2 Working exploit published5 Forecast only3 No public exploit311 2017355 Protected by Waratek24 Mitigation candidate5 No exploit published326 Medium355 blocked by ARMR today24 not blocked331 Working exploit published9 Proof of concept only1 No public exploit345 2018487 Protected by Waratek51 Mitigation candidate8 No exploit published428 Medium487 blocked by ARMR today51 not blocked436 Exploited2 Working exploit published8 No public exploit477 2019454 Protected by Waratek35 Mitigation candidate14 No exploit published405 Medium454 blocked by ARMR today34 partly blocked1 not blocked419 Exploited4 Working exploit published16 Proof of concept only3 No public exploit431 2020546 Protected by Waratek35 Mitigation candidate15 No exploit published496 Medium546 blocked by ARMR today35 not blocked511 Exploited4 Working exploit published11 Proof of concept only3 Forecast only1 No public exploit527 2021331 Protected by Waratek29 Mitigation candidate11 No exploit published291 Medium331 blocked by ARMR today29 not blocked302 Exploited8 Working exploit published6 Proof of concept only6 Forecast only12 No public exploit299 2022371 Protected by Waratek39 Mitigation candidate2 No exploit published330 Medium371 blocked by ARMR today39 not blocked332 Exploited1 Working exploit published2 Proof of concept only6 Forecast only6 No public exploit356
200020022004200620082010201220142016201820202022
4,530 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 46 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2022-34818 Medium 2022-06-30 No exploit published No public exploit Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
CVE-2022-34817 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
CVE-2022-34816 Medium 2022-06-30 No exploit published No public exploit Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34815 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
CVE-2022-34814 Medium 2022-06-30 No exploit published No public exploit Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
CVE-2022-34813 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
CVE-2022-34812 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
CVE-2022-34811 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
CVE-2022-34810 Medium 2022-06-30 No exploit published No public exploit A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34809 Medium 2022-06-30 No exploit published No public exploit Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34808 Medium 2022-06-30 No exploit published No public exploit Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34807 Medium 2022-06-30 No exploit published No public exploit Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34806 Medium 2022-06-30 No exploit published No public exploit Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-34805 Medium 2022-06-30 No exploit published No public exploit Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34804 Medium 2022-06-30 No exploit published No public exploit Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
CVE-2022-34803 Medium 2022-06-30 No exploit published No public exploit Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.
CVE-2022-34802 Medium 2022-06-30 No exploit published No public exploit Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801 Medium 2022-06-30 No exploit published No public exploit Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800 Medium 2022-06-30 No exploit published No public exploit Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34795 Medium 2022-06-30 No exploit published No public exploit Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
CVE-2022-34794 Medium 2022-06-30 No exploit published No public exploit Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVE-2022-34791 Medium 2022-06-30 No exploit published No public exploit Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34790 Medium 2022-06-30 No exploit published No public exploit Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34789 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds.
CVE-2022-34788 Medium 2022-06-30 No exploit published No public exploit Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
CVE-2022-34787 Medium 2022-06-30 No exploit published No public exploit Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
CVE-2022-34786 Medium 2022-06-30 No exploit published No public exploit Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2022-34785 Medium 2022-06-30 No exploit published No public exploit Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34784 Medium 2022-06-30 No exploit published No public exploit Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
CVE-2022-34783 Medium 2022-06-30 No exploit published Forecast only Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34782 Medium 2022-06-30 No exploit published No public exploit An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34781 Medium 2022-06-30 No exploit published No public exploit Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-34780 Medium 2022-06-30 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-34779 Medium 2022-06-30 No exploit published No public exploit A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34778 Medium 2022-06-30 No exploit published No public exploit Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.
CVE-2022-34777 Medium 2022-06-30 No exploit published Forecast only Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34305 Medium 2022-06-23 Protected by Waratek Exploited In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
CVE-2022-34298 Medium 2022-06-23 No exploit published No public exploit The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
CVE-2022-34213 Medium 2022-06-23 No exploit published No public exploit Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34212 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
CVE-2022-34211 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.
CVE-2022-34210 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34209 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-34208 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34207 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-34206 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34205 Medium 2022-06-23 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34202 Medium 2022-06-23 No exploit published No public exploit Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34201 Medium 2022-06-23 No exploit published No public exploit A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34199 Medium 2022-06-23 No exploit published No public exploit Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-34198 Medium 2022-06-23 No exploit published No public exploit Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34197 Medium 2022-06-23 No exploit published No public exploit Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34196 Medium 2022-06-23 No exploit published No public exploit Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34195 Medium 2022-06-23 No exploit published No public exploit Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34194 Medium 2022-06-23 No exploit published No public exploit Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34193 Medium 2022-06-23 No exploit published No public exploit Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34192 Medium 2022-06-23 No exploit published No public exploit Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191 Medium 2022-06-23 No exploit published No public exploit Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34190 Medium 2022-06-23 No exploit published No public exploit Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34189 Medium 2022-06-23 No exploit published No public exploit Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188 Medium 2022-06-23 No exploit published No public exploit Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34187 Medium 2022-06-23 No exploit published No public exploit Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34186 Medium 2022-06-23 No exploit published No public exploit Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34185 Medium 2022-06-23 No exploit published No public exploit Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34184 Medium 2022-06-23 No exploit published No public exploit Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34183 Medium 2022-06-23 No exploit published No public exploit Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34182 Medium 2022-06-23 No exploit published No public exploit Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2022-34178 Medium 2022-06-23 No exploit published No public exploit Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2022-34176 Medium 2022-06-23 No exploit published Forecast only Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
CVE-2022-34173 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-34172 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34171 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
CVE-2022-34170 Medium 2022-06-23 Protected by Waratek No public exploit In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2022-33113 Medium 2022-06-23 No exploit published No public exploit Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVE-2022-32549 Medium 2022-06-22 No exploit published No public exploit Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
CVE-2022-24969 Medium 2022-06-09 No exploit published No public exploit bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2022-29770 Medium 2022-06-03 No exploit published No public exploit XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
CVE-2022-29648 Medium 2022-06-02 No exploit published No public exploit A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.
CVE-2022-30973 Medium 2022-05-31 No exploit published No public exploit We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.
CVE-2022-29405 Medium 2022-05-25 No exploit published No public exploit In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8
CVE-2022-29237 Medium 2022-05-24 No exploit published No public exploit Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.
CVE-2022-1848 Medium 2022-05-24 No exploit published No public exploit Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
CVE-2021-3629 Medium 2022-05-24 No exploit published No public exploit A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
CVE-2021-3597 Medium 2022-05-24 No exploit published No public exploit A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
CVE-2022-22365 Medium 2022-05-20 No exploit published No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.
CVE-2022-22976 Medium 2022-05-19 No exploit published No public exploit Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
CVE-2022-1782 Medium 2022-05-18 No exploit published No public exploit Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
CVE-2022-30970 Medium 2022-05-17 No exploit published No public exploit Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30968 Medium 2022-05-17 No exploit published No public exploit Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30967 Medium 2022-05-17 No exploit published No public exploit Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30966 Medium 2022-05-17 No exploit published No public exploit Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30965 Medium 2022-05-17 No exploit published No public exploit Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30964 Medium 2022-05-17 No exploit published No public exploit Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30963 Medium 2022-05-17 No exploit published No public exploit Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-30962 Medium 2022-05-17 No exploit published No public exploit Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
‹ prev page 1 of 46 next ›