Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28080 State: PUBLISHED Published: 2022-05-05T16:06:34 Last Updated: 2024-08-03T05:41:11.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip - https://github.com/erengozaydin/Royal-Event-Management-System-todate-SQL-Injection-Authenticated - http://packetstormsecurity.com/files/167123/Royal-Event-Manageme
-Management-System-todate-SQL-Injection-Authenticated - http://packetstormsecurity.com/files/167123/Royal-Event-Management-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-28081 State: PUBLISHED Published: 2022-05-04T13:11:46 Last Updated: 2024-08-03T05:41:11.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts. Additional Analyst Notes: - CVE Program Container: References: - https://albarbari.com/2022/03/24/arPHP-xss.html
CVE ID: CVE-2022-28082 State: PUBLISHED Published: 2022-05-04T13:09:46 Last Updated: 2024-08-03T05:41:11.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eeeeeeeeeeeeeeeea/IOT-vulhub/tree/main/TendaAX12
CVE ID: CVE-2022-28085 State: PUBLISHED Published: 2022-04-27T02:19:23 Last Updated: 2024-08-03T05:48:36.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/htmldoc/issues/480 - https://github.com/michaelrsweet/htmldoc/commit/46c8ec2b9bccb8ccabff52d998c5eee77a228348
CVE ID: CVE-2022-28090 State: PUBLISHED Published: 2022-05-04T13:06:04 Last Updated: 2024-08-03T05:48:36.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/jspxcms/Jspxcms/issues/I4ZKDR
CVE ID: CVE-2022-28093 State: PUBLISHED Published: 2022-04-25T13:09:45 Last Updated: 2024-08-03T05:48:36.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - http://scbs.com - https://github.com/wkeyi0x1/vul-report/blob/main/SCBS%20online%20sports%20venue%20reservation%20system/SCBS%20online%20sports%20venue%20reservation%20system%20v1.0%20-%20File%20Inclusion.md - https://www.sourcecodester.com/php/15236/online-sports-complex-booking-s
ion%20system%20v1.0%20-%20File%20Inclusion.md - https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
CVE ID: CVE-2022-28094 State: PUBLISHED Published: 2022-04-25T13:09:46 Last Updated: 2024-08-03T05:48:36.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at booking.php. Additional Analyst Notes: - CVE Program Container: References: - http://scbs.com - https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html - https://github.com/wkeyi0x1/vul-report/blob/main/SCBS%20online%20sports%20venue%20reservation%20system/SCBS%20online%20sports%20venue%20reservation%20system%20v1.0%20-%20Self-XSS.md
CVE ID: CVE-2022-28096 State: PUBLISHED Published: 2022-05-04T12:59:56 Last Updated: 2024-08-03T05:48:36.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zorlan/skycaiji/issues/39
CVE ID: CVE-2022-28099 State: PUBLISHED Published: 2022-05-04T13:20:15 Last Updated: 2024-08-03T05:48:36.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip - https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html - https://github.com/IbrahimEkimIsik/CVE-2022-28099/blob/main/SQL%20Injection%20For%20Poultry%20Farm%20Management%20system%201.0
CVE ID: CVE-2022-28101 State: PUBLISHED Published: 2022-04-28T13:55:08 Last Updated: 2024-08-03T05:48:36.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cybercitadel.com/html-injection-turtl/ - https://github.com/turtl/tracker/issues/404
CVE ID: CVE-2022-28102 State: PUBLISHED Published: 2022-04-28T14:00:27 Last Updated: 2024-08-03T05:48:37.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php. Additional Analyst Notes: - CVE Program Container: References: - http://php-mysql-admin-panel-generator.com - https://github.com/housamz/php-mysql-admin-panel-generator/issues/19
CVE ID: CVE-2022-28104 State: PUBLISHED Published: 2022-05-20T12:48:03 Last Updated: 2024-08-03T05:48:36.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://packetstormsecurity.com/files/166430
CVE ID: CVE-2022-28105 State: PUBLISHED Published: 2022-05-20T12:48:14 Last Updated: 2024-08-03T05:48:37.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_facility.php. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2022030105
CVE ID: CVE-2022-28106 State: PUBLISHED Published: 2022-05-20T12:48:15 Last Updated: 2024-08-03T05:48:36.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2022030104
CVE ID: CVE-2022-28108 State: PUBLISHED Published: 2022-04-19T02:55:37 Last Updated: 2024-08-03T05:48:36.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/02/07/3 - https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ - https://www.selenium.dev/downloads/
CVE ID: CVE-2022-28109 State: PUBLISHED Published: 2022-04-15T15:50:26 Last Updated: 2024-08-03T05:48:37.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine. Additional Analyst Notes: - CVE Program Container: References:
is can be used to execute arbitrary code on the machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/02/07/3 - https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/ - http://www.openwall.com/lists/oss-security/2022/04/16/1
CVE ID: CVE-2022-28110 State: PUBLISHED Published: 2022-05-10T12:01:23 Last Updated: 2024-08-03T05:48:36.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/SQL_Injection - https://medium.com/%40honeyakshat999/hotel-management-system-sql-injection-on-login-page-a1ca87a31176
CVE ID: CVE-2022-28111 State: PUBLISHED Published: 2022-05-04T00:00:00 Last Updated: 2024-08-03T05:48:37.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/secload/articles/16061420.html - https://pagehelper.github.io/ - https://github.com/pagehelper/Mybatis-PageHelper - https://github.com/pagehelper/Mybatis-PageHelper.git - https://github.com/pagehelper/Mybatis-PageHelper/issues/674 - https://github.com/yangfar/CVE/blob/main/CVE-2022-4222
t - https://github.com/pagehelper/Mybatis-PageHelper/issues/674 - https://github.com/yangfar/CVE/blob/main/CVE-2022-42227.md
CVE ID: CVE-2022-28113 State: PUBLISHED Published: 2022-04-15T18:08:17 Last Updated: 2024-08-03T05:48:36.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1OvpNieX3pYFaZprglr5T0lV0WuLoLcLu/view?usp=sharing - https://drive.google.com/file/d/1s1AgI5Dw7_GNenmI-mw0Sx2B9MkNTbc7/view?usp=sharing - https://github.com/code-byter/CVE-2022-28113 - https://code-byter.com/2022/04/06/fantec-wifi.html
CVE ID: CVE-2022-28114 State: PUBLISHED Published: 2022-04-28T14:10:51 Last Updated: 2024-08-03T05:48:37.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/csdeshang/DSCMS_open/issues/3
CVE ID: CVE-2022-28115 State: PUBLISHED Published: 2022-04-05T19:03:03 Last Updated: 2024-08-03T05:48:37.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Sports-Complex-Booking
CVE ID: CVE-2022-28116 State: PUBLISHED Published: 2022-04-05T19:03:04 Last Updated: 2024-08-03T05:48:36.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Banking-System
CVE ID: CVE-2022-28117 State: PUBLISHED Published: 2022-04-28T14:13:46 Last Updated: 2024-08-03T05:48:37.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.navigatecms.com/en/blog/development/navigate_cms_update_2_9_5 - https://www.youtube.com/watch?v=4kHW95CMfD0 - http://packetstormsecurity.com/files/167063/Navigate-CMS-2.9.4-Server-Side-Request-Forgery.html
CVE ID: CVE-2022-28118 State: PUBLISHED Published: 2022-05-03T00:08:02 Last Updated: 2024-08-03T05:48:37.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/siteserver/cms - http://siteserver.com - https://github.com/Richard-Tang/SSCMS-PluginShell/blob/main/Detail.md - https://github.com/siteserver/cms/issues/3386
CVE ID: CVE-2022-28120 State: PUBLISHED Published: 2022-05-05T16:02:54 Last Updated: 2024-08-03T05:48:36.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2021-39055
CVE ID: CVE-2022-28126 State: PUBLISHED Published: 2022-11-11T15:48:46.764Z Last Updated: 2025-02-05T20:47:19.981Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) XMM(TM) 7560 Modem software Problem Types: escalation of privilege Description: Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00683.html
CVE ID: CVE-2022-28127 State: PUBLISHED Published: 2022-06-30T19:05:20.796Z Last Updated: 2025-04-15T19:00:16.368Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-20 Description: A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1571
CVE ID: CVE-2022-28128 State: PUBLISHED Published: 2022-03-31T07:21:53 Last Updated: 2024-08-03T05:48:36.845Z Vendors: HiBARA Software Products: AttacheCase Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://hibara.org/software/attachecase/?lang=en - https://jvn.jp/en/jp/JVN10140834/index.html
CVE ID: CVE-2022-28129 State: PUBLISHED Published: 2022-08-10T00:00:00 Last Updated: 2024-08-03T05:48:36.561Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 - https://www.debian.org/security/2022/dsa-5206 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYID
206 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html
CVE ID: CVE-2022-28131 State: PUBLISHED Published: 2022-08-09T00:00:00 Last Updated: 2024-08-03T05:48:36.830Z Vendors: Go standard library Products: encoding/xml Problem Types: CWE-674: Uncontrolled Recursion Description: Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/417062 - https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3 - https://go.dev/issue/53614 - https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE - https://pkg.go.dev/vuln/GO-2022-0521
CVE ID: CVE-2022-28132 State: PUBLISHED Published: 2024-05-14T20:20:37.565Z Last Updated: 2025-02-13T15:46:22.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/50939
CVE ID: CVE-2022-28133 State: PUBLISHED Published: 2022-03-29T12:30:43 Last Updated: 2024-08-03T05:48:36.605Z Vendors: Jenkins project Products: Jenkins Bitbucket Server Integration Plugin Description: Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2639 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28134 State: PUBLISHED Published: 2022-03-29T12:30:45 Last Updated: 2024-08-03T05:48:36.842Z Vendors: Jenkins project Products: Jenkins Bitbucket Server Integration Plugin Description: Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2640 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28135 State: PUBLISHED Published: 2022-03-29T12:30:47 Last Updated: 2024-08-03T05:48:37.169Z Vendors: Jenkins project Products: Jenkins instant-messaging Plugin Description: Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2161 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28136 State: PUBLISHED Published: 2022-03-29T12:30:48 Last Updated: 2024-10-15T18:35:10.138Z Vendors: Jenkins project Products: Jenkins JiraTestResultReporter Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2236 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28137 State: PUBLISHED Published: 2022-03-29T12:30:50 Last Updated: 2024-08-03T05:48:37.679Z Vendors: Jenkins project Products: Jenkins JiraTestResultReporter Plugin Description: A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2236 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28138 State: PUBLISHED Published: 2022-03-29T12:30:51 Last Updated: 2024-08-03T05:48:37.870Z Vendors: Jenkins project Products: Jenkins RocketChat Notifier Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2241 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28139 State: PUBLISHED Published: 2022-03-29T12:30:53 Last Updated: 2024-08-03T05:48:36.808Z Vendors: Jenkins project Products: Jenkins RocketChat Notifier Plugin Description: A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2241 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28140 State: PUBLISHED Published: 2022-03-29T12:30:55 Last Updated: 2024-08-03T05:48:37.205Z Vendors: Jenkins project Products: Jenkins Flaky Test Handler Plugin Description: Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-1896 - http://www.openwall.com/lists/oss-security/2022/03/29/1
CVE ID: CVE-2022-28141 State: PUBLISHED Published: 2022-03-29T12:30:56 Last Updated: 2024-08-03T05:48:36.817Z Vendors: Jenkins project Products: Jenkins Proxmox Plugin Description: Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2079 - http://www.openwall.com/lists/oss-security/2022/03/29/1