Overview 4,029 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 22 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4,029
100.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
4,029
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
7
0.2%
Forecast only
22
0.5%
No public exploit
4,000
99.3%
split by
peak 496 / year
20003
No exploit published3
Medium3
not blocked3
No public exploit3
20014
No exploit published4
Medium4
not blocked4
No public exploit4
200215
No exploit published15
Medium15
not blocked15
Forecast only1
No public exploit14
200318
No exploit published18
Medium18
not blocked18
No public exploit18
200416
No exploit published16
Medium16
not blocked16
No public exploit16
200539
No exploit published39
Medium39
not blocked39
No public exploit39
200648
No exploit published48
Medium48
not blocked48
No public exploit48
200760
No exploit published60
Medium60
not blocked60
No public exploit60
200871
No exploit published71
Medium71
not blocked71
No public exploit71
2009115
No exploit published115
Medium115
not blocked115
No public exploit115
2010118
No exploit published118
Medium118
not blocked118
Forecast only1
No public exploit117
2011132
No exploit published132
Medium132
not blocked132
No public exploit132
2012177
No exploit published177
Medium177
not blocked177
No public exploit177
2013225
No exploit published225
Medium225
not blocked225
Forecast only1
No public exploit224
2014215
No exploit published215
Medium215
not blocked215
No public exploit215
2015205
No exploit published205
Medium205
not blocked205
No public exploit205
2016292
No exploit published292
Medium292
not blocked292
No public exploit292
2017326
No exploit published326
Medium326
not blocked326
No public exploit326
2018428
No exploit published428
Medium428
not blocked428
No public exploit428
2019405
No exploit published405
Medium405
not blocked405
No public exploit405
2020496
No exploit published496
Medium496
not blocked496
Forecast only1
No public exploit495
2021291
No exploit published291
Medium291
not blocked291
Proof of concept only3
Forecast only12
No public exploit276
2022330
No exploit published330
Medium330
not blocked330
Proof of concept only4
Forecast only6
No public exploit320
200020022004200620082010201220142016201820202022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-34818 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs. |
| CVE-2022-34817 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
| CVE-2022-34816 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34815 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs. |
| CVE-2022-34814 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests. |
| CVE-2022-34813 | Medium | 2022-06-30 | No exploit published | No public exploit | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions. |
| CVE-2022-34812 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions. |
| CVE-2022-34811 | Medium | 2022-06-30 | No exploit published | No public exploit | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. |
| CVE-2022-34810 | Medium | 2022-06-30 | No exploit published | No public exploit | A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2022-34809 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34808 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34807 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34806 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2022-34805 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34804 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure. |
| CVE-2022-34803 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system. |
| CVE-2022-34802 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34801 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. |
| CVE-2022-34800 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34799 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34798 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials. |
| CVE-2022-34797 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials. |
| CVE-2022-34796 | Medium | 2022-06-30 | No exploit published | No public exploit | A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2022-34795 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. |
| CVE-2022-34794 | Medium | 2022-06-30 | No exploit published | No public exploit | Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. |
| CVE-2022-34791 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34790 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34789 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
| CVE-2022-34788 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. |
| CVE-2022-34787 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked. |
| CVE-2022-34786 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs. |
| CVE-2022-34785 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them. |
| CVE-2022-34784 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission. |
| CVE-2022-34783 | Medium | 2022-06-30 | No exploit published | Forecast only | Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34782 | Medium | 2022-06-30 | No exploit published | No public exploit | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. |
| CVE-2022-34781 | Medium | 2022-06-30 | No exploit published | No public exploit | Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2022-34780 | Medium | 2022-06-30 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2022-34779 | Medium | 2022-06-30 | No exploit published | No public exploit | A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2022-34778 | Medium | 2022-06-30 | No exploit published | No public exploit | Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. |
| CVE-2022-34777 | Medium | 2022-06-30 | No exploit published | Forecast only | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34298 | Medium | 2022-06-23 | No exploit published | No public exploit | The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." |
| CVE-2022-34213 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34212 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL. |
| CVE-2022-34211 | Medium | 2022-06-23 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL. |
| CVE-2022-34210 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2022-34209 | Medium | 2022-06-23 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
| CVE-2022-34208 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2022-34207 | Medium | 2022-06-23 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
| CVE-2022-34206 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL. |
| CVE-2022-34205 | Medium | 2022-06-23 | No exploit published | No public exploit | A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL. |
| CVE-2022-34204 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. |
| CVE-2022-34202 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. |
| CVE-2022-34201 | Medium | 2022-06-23 | No exploit published | No public exploit | A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
| CVE-2022-34199 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2022-34198 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34197 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34196 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34195 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34194 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34193 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34192 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34191 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34190 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34189 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34188 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34187 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34186 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34185 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34184 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34183 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34182 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. |
| CVE-2022-34178 | Medium | 2022-06-23 | No exploit published | No public exploit | Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability. |
| CVE-2022-34176 | Medium | 2022-06-23 | No exploit published | Forecast only | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. |
| CVE-2022-33113 | Medium | 2022-06-23 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. |
| CVE-2022-32549 | Medium | 2022-06-22 | No exploit published | No public exploit | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files. |
| CVE-2022-24969 | Medium | 2022-06-09 | No exploit published | No public exploit | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability. |
| CVE-2022-29770 | Medium | 2022-06-03 | No exploit published | No public exploit | XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo. |
| CVE-2022-29648 | Medium | 2022-06-02 | No exploit published | No public exploit | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
| CVE-2022-30973 | Medium | 2022-05-31 | No exploit published | No public exploit | We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3. |
| CVE-2022-29405 | Medium | 2022-05-25 | No exploit published | No public exploit | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 |
| CVE-2022-29237 | Medium | 2022-05-24 | No exploit published | No public exploit | Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7. |
| CVE-2022-1848 | Medium | 2022-05-24 | No exploit published | No public exploit | Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. |
| CVE-2021-3629 | Medium | 2022-05-24 | No exploit published | No public exploit | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final. |
| CVE-2021-3597 | Medium | 2022-05-24 | No exploit published | No public exploit | A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final. |
| CVE-2022-22365 | Medium | 2022-05-20 | No exploit published | No public exploit | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904. |
| CVE-2022-22976 | Medium | 2022-05-19 | No exploit published | No public exploit | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE. |
| CVE-2022-1782 | Medium | 2022-05-18 | No exploit published | No public exploit | Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11. |
| CVE-2022-30970 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30968 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30967 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30966 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30965 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30964 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30963 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30962 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30961 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30960 | Medium | 2022-05-17 | No exploit published | No public exploit | Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-30959 | Medium | 2022-05-17 | No exploit published | No public exploit | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. |
| CVE-2022-30957 | Medium | 2022-05-17 | No exploit published | No public exploit | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2022-30956 | Medium | 2022-05-17 | No exploit published | Forecast only | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. |