Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
x=32,64,96, y=T,R, z=D,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 179**** and prior and versions prior to 1.073, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS) versions prior to 1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi E
1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) version 1.000 allows a remote unauthenticated attacker to cause a DoS condition for the product's program execution or communication by sending specially crafted packets. System reset of the product is required for recovery. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-004_en.pdf - https://jvn.jp/vu/JVNVU95926817/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-139-01
CVE ID: CVE-2022-25162 State: PUBLISHED Published: 2022-05-18T16:34:50 Last Updated: 2024-08-03T04:29:01.922Z Vendors: n/a Products: Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS); Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R); Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z
1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) version 1.000 allows a remote unauthenticated attacker to cause a temporary DoS condition for the product's communication by sending specially crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-004_en.pdf - https://jvn.jp/vu/JVNVU95926817/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-139-01
CVE ID: CVE-2022-25163 State: PUBLISHED Published: 2022-06-02T16:54:11 Last Updated: 2024-08-03T04:36:05.046Z Vendors: n/a Products: Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N Problem Types: Improper Input Validation Description: Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electric MELSEC-L series LJ71E71-100 first 5 digits of serial number "24061" or prior and Mitsubishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker t
subishi Electric MELSEC iQ-R Series RD81MES96N firmware version "08" or prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on the target products by sending specially crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-006_en.pdf - https://jvn.jp/vu/JVNVU92561747/index.html
CVE ID: CVE-2022-25164 State: PUBLISHED Published: 2022-11-24T23:21:25.536Z Last Updated: 2025-04-25T17:52:48.881Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3, MX OPC UA Module Configurator-R Problem Types: CWE-312 Description: Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Module Configurator-R versions 1.08J and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSE
information. As a result, unauthenticated attackers can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-25165 State: PUBLISHED Published: 2022-04-14T15:19:00 Last Updated: 2024-08-03T04:36:05.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial con
rary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RhinoSecurityLabs/CVEs - https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
CVE ID: CVE-2022-25166 State: PUBLISHED Published: 2022-04-14T15:18:53 Last Updated: 2024-08-03T04:36:05.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file. Additional Analyst Notes: - CVE Program Container: References: -
user open a crafted malicious ovpn configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RhinoSecurityLabs/CVEs - https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client/
CVE ID: CVE-2022-25167 State: PUBLISHED Published: 2022-06-14T07:55:10 Last Updated: 2024-08-03T04:36:05.047Z Vendors: Apache Software Foundation Products: Apache Flume Problem Types: CWE-20, CWE-74 Description: Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg - https://issues.apache.org/jira/brow
er: References: - https://lists.apache.org/thread/16nf6b81zjpdc4y93ho99oxo83ddbsvg - https://issues.apache.org/jira/browse/FLUME-3416 - http://www.openwall.com/lists/oss-security/2022/06/14/1
CVE ID: CVE-2022-25168 State: PUBLISHED Published: 2022-08-04T14:30:17 Last Updated: 2024-08-03T04:36:05.786Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: CWE-78 Description: Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath,
s used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130 - https://security.netapp.com/advisory/ntap-20220915-0007/
CVE ID: CVE-2022-25169 State: PUBLISHED Published: 2022-05-16T17:05:11 Last Updated: 2024-08-03T04:36:05.111Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: DoS caused by unreasonable memory allocation Description: The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/t3tb51sf0k2pmbnzsrrrm23z9r1c10rk - http://www.openwall.com/lists/oss-security/2022/05/16/4 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220804-0004/
CVE ID: CVE-2022-25170 State: PUBLISHED Published: 2022-02-25T18:10:55.131Z Last Updated: 2025-04-16T18:00:47.051Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: FvDesigner Problem Types: CWE-121 Description: The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-055-01
CVE ID: CVE-2022-25171 State: PUBLISHED Published: 2022-12-21T01:21:43.830Z Last Updated: 2025-04-16T14:42:51.719Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: p4 Problem Types: Command Injection Description: The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-P4-3167330 - https://github.com/natelong/p4/blob/master/p4.js%23L12 - https://github.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb
CVE ID: CVE-2022-25172 State: PUBLISHED Published: 2022-05-12T17:01:34.630Z Last Updated: 2025-04-15T19:03:19.864Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-1004 Description: An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/u
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1470
CVE ID: CVE-2022-25173 State: PUBLISHED Published: 2022-02-15T16:10:50 Last Updated: 2024-08-03T04:36:05.779Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25174 State: PUBLISHED Published: 2022-02-15T16:10:52 Last Updated: 2024-08-03T04:36:06.646Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463
CVE ID: CVE-2022-25175 State: PUBLISHED Published: 2022-02-15T00:00:00 Last Updated: 2024-08-03T04:36:06.194Z Vendors: Jenkins project Products: Jenkins Pipeline: Multibranch Plugin Description: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463
CVE ID: CVE-2022-25176 State: PUBLISHED Published: 2022-02-15T16:10:55 Last Updated: 2024-10-15T17:14:05.406Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
CVE ID: CVE-2022-25177 State: PUBLISHED Published: 2022-02-15T16:10:56 Last Updated: 2024-08-03T04:36:06.654Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
CVE ID: CVE-2022-25178 State: PUBLISHED Published: 2022-02-15T16:10:58 Last Updated: 2024-08-03T04:36:06.504Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
CVE ID: CVE-2022-25179 State: PUBLISHED Published: 2022-02-15T00:00:00 Last Updated: 2024-08-03T04:36:05.767Z Vendors: Jenkins project Products: Jenkins Pipeline: Multibranch Plugin Description: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
CVE ID: CVE-2022-25180 State: PUBLISHED Published: 2022-02-15T16:11:02 Last Updated: 2024-08-03T04:36:06.394Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2443
CVE ID: CVE-2022-25181 State: PUBLISHED Published: 2022-02-15T16:11:03 Last Updated: 2024-08-03T04:36:05.788Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2441
CVE ID: CVE-2022-25182 State: PUBLISHED Published: 2022-02-15T16:11:05 Last Updated: 2024-11-19T19:28:36.784Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2422
CVE ID: CVE-2022-25183 State: PUBLISHED Published: 2022-02-15T16:11:07 Last Updated: 2024-08-03T04:36:06.299Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/secur
se caching already exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2586
CVE ID: CVE-2022-25184 State: PUBLISHED Published: 2022-02-15T16:11:08 Last Updated: 2024-08-03T04:36:06.364Z Vendors: Jenkins project Products: Jenkins Pipeline: Build Step Plugin Description: Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2519
CVE ID: CVE-2022-25185 State: PUBLISHED Published: 2022-02-15T16:11:10 Last Updated: 2024-08-03T04:36:05.762Z Vendors: Jenkins project Products: Jenkins Generic Webhook Trigger Plugin Description: Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2592 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25186 State: PUBLISHED Published: 2022-02-15T16:11:11 Last Updated: 2024-08-03T04:36:06.418Z Vendors: Jenkins project Products: Jenkins HashiCorp Vault Plugin Description: Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2429
CVE ID: CVE-2022-25187 State: PUBLISHED Published: 2022-02-15T16:11:13 Last Updated: 2024-08-03T04:36:06.450Z Vendors: Jenkins project Products: Jenkins Support Core Plugin Description: Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186
CVE ID: CVE-2022-25188 State: PUBLISHED Published: 2022-02-15T16:11:14 Last Updated: 2024-08-03T04:36:05.956Z Vendors: Jenkins project Products: Jenkins Fortify Plugin Description: Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2214 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25189 State: PUBLISHED Published: 2022-02-15T16:11:15 Last Updated: 2024-08-03T04:36:05.782Z Vendors: Jenkins project Products: Jenkins Custom Checkbox Parameter Plugin Description: Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2266
CVE ID: CVE-2022-25190 State: PUBLISHED Published: 2022-02-15T16:11:17 Last Updated: 2024-10-15T17:13:57.861Z Vendors: Jenkins project Products: Jenkins Conjur Secrets Plugin Description: A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2350
CVE ID: CVE-2022-25191 State: PUBLISHED Published: 2022-02-15T16:11:18 Last Updated: 2024-08-03T04:36:05.930Z Vendors: Jenkins project Products: Jenkins Agent Server Parameter Plugin Description: Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2268