Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-34763 State: PUBLISHED Published: 2022-07-13T21:11:02.182221Z Last Updated: 2024-09-16T18:59:40.882Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-345 Description: A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional
n Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34764 State: PUBLISHED Published: 2022-07-13T21:11:05.954357Z Last Updated: 2024-09-16T18:29:14.835Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-119 Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: Re
OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34765 State: PUBLISHED Published: 2022-07-13T21:11:13.251866Z Last Updated: 2024-09-16T19:40:21.506Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-73 Description: A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is written to the file path. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Note
ENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34767 State: PUBLISHED Published: 2022-07-21T15:37:00 Last Updated: 2024-08-03T09:22:10.317Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ALLNET Gmbh Products: ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan Problem Types: Authorization Bypass Description: Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and can be accessed publicly. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-34768 State: PUBLISHED Published: 2022-08-05T15:24:50.903913Z Last Updated: 2024-09-16T17:48:16.631Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Synel Products: eHarmony Problem Types: CWE-79 Description: insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34769 State: PUBLISHED Published: 2022-08-05T15:25:06.930961Z Last Updated: 2024-09-16T17:08:43.887Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Michlol Products: Michlol - rashim web Problem Types: interface Insecure direct object references Description: Michlol - rashim web interface Insecure direct object references (IDOR). First of all, the attacker needs to login. After he performs log into the system there are some functionalities that the specific user is not allowed to perform. However all the attacker needs to do in order to achieve his goals is to change the value of the ptMsl parameter and then the attacker can access sensitiv
do in order to achieve his goals is to change the value of the ptMsl parameter and then the attacker can access sensitive data that he not supposed to access because its belong to another user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-34770 State: PUBLISHED Published: 2022-08-22T14:41:16.634296Z Last Updated: 2024-09-17T04:24:31.052Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: sensitive information disclosure Description: Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoDB ID which is not so simple to enumerate. However, they each receive a ‘tiny URL’ in Tabit’s domain, in the form of http
B ID which is not so simple to enumerate. However, they each receive a ‘tiny URL’ in Tabit’s domain, in the form of https://tbit.be/{suffix} with suffix being a 5 characters long string containing numbers, lower- and upper-case letters. It is not so simple to enumerate them all, but really easy to find some that work and lead to a personal endpoint. This is both an example of OWASP: API4 - rate limiting and OWASP: API1 - Broken object level authorization. Furthermore, the redirect URL disclosed the MongoDB IDs discussed above, and we could use them to query other endpoints disclosing more personal information. For example: The URL https://tabitisrael.co.il/online-reservations/health-statemen
disclosing more personal information. For example: The URL https://tabitisrael.co.il/online-reservations/health-statement?orgId={org_id}&healthStatementId={health_statement_id} is used to invite friends to fill a health statement before attending the restaurant. We can use the health_statement_id to access the https://tgm-api.tabit.cloud/health-statement/{health_statement_id} API which disclose medical information as well as id number. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34771 State: PUBLISHED Published: 2022-08-22T14:40:51.365331Z Last Updated: 2024-09-16T20:48:05.000Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: arbitrary SMS send on Tabits behalf Description: Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the cus
he system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34772 State: PUBLISHED Published: 2022-08-22T14:42:58.504211Z Last Updated: 2024-09-17T02:57:43.020Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: password enumeration Description: Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34773 State: PUBLISHED Published: 2022-08-22T14:41:38.251675Z Last Updated: 2024-09-16T18:49:05.405Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: HTTP Method manipulation Description: Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34774 State: PUBLISHED Published: 2022-08-22T14:41:59.673405Z Last Updated: 2024-09-17T03:55:05.773Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: Arbitrary account modification Description: Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email addresses and phone numbers of a specific user in a restaurant's loyalty program. Possibly allowing account takeover (the mail can be used to reset password). Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq
reset password). Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34775 State: PUBLISHED Published: 2022-08-22T14:42:21.732388Z Last Updated: 2024-09-17T04:09:02.934Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: Excessive data exposure Description: Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this s
ot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34776 State: PUBLISHED Published: 2022-08-22T14:42:38.815183Z Last Updated: 2024-09-16T18:23:56.904Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tabit Products: Tabit Problem Types: giftcard stealth Description: Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not so simple to enumerate. However, they each receive a 'tiny URL' in tabits domain, in the form of https://tbit.be/{suffix} with suffix b
umerate. However, they each receive a 'tiny URL' in tabits domain, in the form of https://tbit.be/{suffix} with suffix being a 5 character long string containing numbers, lower and upper case letters. It is not so simple to enumerate them all, but really easy to find some that work and lead to a personal endpoint. Furthermore, the redirect URL disclosed the MongoDB IDs discussed above, and we could use them to query other endpoints disclosing more personal information. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-34777 State: PUBLISHED Published: 2022-06-30T17:45:54 Last Updated: 2024-08-03T09:22:10.421Z Vendors: Jenkins project Products: Jenkins GitLab Plugin Description: Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2316
CVE ID: CVE-2022-34778 State: PUBLISHED Published: 2022-06-30T17:45:59 Last Updated: 2024-11-20T15:46:21.953Z Vendors: Jenkins project Products: Jenkins TestNG Results Plugin Description: Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2788
CVE ID: CVE-2022-34779 State: PUBLISHED Published: 2022-06-30T17:46:05 Last Updated: 2024-08-03T09:22:10.384Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Release Plugin Description: A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%281%29
CVE ID: CVE-2022-34780 State: PUBLISHED Published: 2022-06-30T17:46:10 Last Updated: 2024-08-03T09:22:10.389Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Release Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29
CVE ID: CVE-2022-34781 State: PUBLISHED Published: 2022-06-30T17:46:18 Last Updated: 2024-11-20T15:47:23.855Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Release Plugin Description: Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29
CVE ID: CVE-2022-34782 State: PUBLISHED Published: 2022-06-30T17:46:21 Last Updated: 2024-08-03T09:22:09.947Z Vendors: Jenkins project Products: Jenkins requests-plugin Plugin Description: An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2650
CVE ID: CVE-2022-34783 State: PUBLISHED Published: 2022-06-30T17:46:27 Last Updated: 2024-08-03T09:22:10.220Z Vendors: Jenkins project Products: Jenkins Plot Plugin Description: Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2220
CVE ID: CVE-2022-34784 State: PUBLISHED Published: 2022-06-30T17:46:33 Last Updated: 2024-08-03T09:22:10.288Z Vendors: Jenkins project Products: Jenkins build-metrics Plugin Description: Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1118
CVE ID: CVE-2022-34785 State: PUBLISHED Published: 2022-06-30T17:46:40 Last Updated: 2024-08-03T09:22:09.973Z Vendors: Jenkins project Products: Jenkins build-metrics Plugin Description: Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2643
CVE ID: CVE-2022-34786 State: PUBLISHED Published: 2022-06-30T17:46:46 Last Updated: 2024-08-03T09:22:10.690Z Vendors: Jenkins project Products: Jenkins Rich Text Publisher Plugin Description: Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2332
CVE ID: CVE-2022-34787 State: PUBLISHED Published: 2022-06-30T17:46:51 Last Updated: 2024-08-03T09:22:10.430Z Vendors: Jenkins project Products: Jenkins Project Inheritance Plugin Description: Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1919
CVE ID: CVE-2022-34788 State: PUBLISHED Published: 2022-06-30T17:46:56 Last Updated: 2024-08-03T09:22:10.169Z Vendors: Jenkins project Products: Jenkins Matrix Reloaded Plugin Description: Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1926
CVE ID: CVE-2022-34789 State: PUBLISHED Published: 2022-06-30T17:47:04 Last Updated: 2024-08-03T09:22:10.633Z Vendors: Jenkins project Products: Jenkins Matrix Reloaded Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2016
CVE ID: CVE-2022-34790 State: PUBLISHED Published: 2022-06-30T17:47:07 Last Updated: 2024-08-03T09:22:10.311Z Vendors: Jenkins project Products: Jenkins eXtreme Feedback Panel Plugin Description: Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1939
CVE ID: CVE-2022-34791 State: PUBLISHED Published: 2022-06-30T17:47:15 Last Updated: 2024-08-03T09:22:10.693Z Vendors: Jenkins project Products: Jenkins Validating Email Parameter Plugin Description: Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2165
CVE ID: CVE-2022-34792 State: PUBLISHED Published: 2022-06-30T17:47:20 Last Updated: 2024-08-03T09:22:10.237Z Vendors: Jenkins project Products: Jenkins Recipe Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE ID: CVE-2022-34793 State: PUBLISHED Published: 2022-06-30T17:47:24 Last Updated: 2024-08-03T09:22:09.994Z Vendors: Jenkins project Products: Jenkins Recipe Plugin Description: Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE ID: CVE-2022-34794 State: PUBLISHED Published: 2022-06-30T17:47:29 Last Updated: 2024-08-03T09:22:10.506Z Vendors: Jenkins project Products: Jenkins Recipe Plugin Description: Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000
CVE ID: CVE-2022-34795 State: PUBLISHED Published: 2022-06-30T17:47:34 Last Updated: 2024-08-03T09:22:10.589Z Vendors: Jenkins project Products: Jenkins Deployment Dashboard Plugin Description: Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2799
CVE ID: CVE-2022-34796 State: PUBLISHED Published: 2022-06-30T17:47:42 Last Updated: 2024-08-03T09:22:10.447Z Vendors: Jenkins project Products: Jenkins Deployment Dashboard Plugin Description: A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%281%29
CVE ID: CVE-2022-34797 State: PUBLISHED Published: 2022-06-30T17:47:47 Last Updated: 2024-08-03T09:22:10.429Z Vendors: Jenkins project Products: Jenkins Deployment Dashboard Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2798%20%282%29