Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wasmi-labs/wasmi/security/advisories/GHSA-75jp-vq8x-h4cq - https://github.com/wasmi-labs/wasmi/commit/f7b3200e9f3dc9e2cbca966cb255c228453c792f - https://github.com/wasmi-labs/wasmi/releases/tag/v0.31.1
CVE ID: CVE-2024-28125 State: PUBLISHED Published: 2024-03-18T07:26:21.298Z Last Updated: 2025-09-19T17:24:24.131Z Vendors: unclebob Products: FitNesse Problem Types: CWE-78 Description: FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/unclebob/fitnesse - http://fitnesse.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob/master/SECURITY.md - https://jvn.jp/en/jp/JVN9452120
se.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob/master/SECURITY.md - https://jvn.jp/en/jp/JVN94521208/
CVE ID: CVE-2024-28126 State: PUBLISHED Published: 2024-03-26T09:57:42.200Z Last Updated: 2024-11-05T21:54:30.114Z Vendors: Zerochannel Products: 0ch BBS Script Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using 0ch BBS Script ver.4.00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN46874970/
CVE ID: CVE-2024-28127 State: PUBLISHED Published: 2025-02-12T21:19:31.374Z Last Updated: 2025-11-03T20:37:06.912Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html
CVE ID: CVE-2024-28128 State: PUBLISHED Published: 2024-03-18T07:31:34.749Z Last Updated: 2025-03-20T19:10:27.895Z Vendors: unclebob Products: FitNesse Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/unclebob/fitnesse - http://fitnesse.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob
https://github.com/unclebob/fitnesse - http://fitnesse.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob/master/SECURITY.md - https://jvn.jp/en/jp/JVN94521208/
CVE ID: CVE-2024-28130 State: PUBLISHED Published: 2024-04-23T14:46:43.296Z Last Updated: 2025-11-04T17:19:39.195Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OFFIS Products: DCMTK Problem Types: CWE-704 Description: An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1957 - https://li
- CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1957 - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2024-28131 State: PUBLISHED Published: 2024-03-26T09:29:13.376Z Last Updated: 2024-08-02T17:14:14.445Z Vendors: sira.jp Products: EasyRange Problem Types: Uncontrolled Search Path Element Description: EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to loading an executable file resides in the same folder where the extracted file is placed. If this vulnerability is exploited, arbitrary code may be executed with the privilege of the running program. Note that the developer was unreachable, therefore, users should consider stop using EasyRange Ver 1.41. Additional Analyst Notes: - CVE Program Con
unreachable, therefore, users should consider stop using EasyRange Ver 1.41. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN13113728/index.html
CVE ID: CVE-2024-28132 State: PUBLISHED Published: 2024-05-08T15:01:27.035Z Last Updated: 2024-08-02T00:48:49.036Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP Next CNF Problem Types: CWE-922 Description: Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000138913
CVE ID: CVE-2024-28133 State: PUBLISHED Published: 2024-05-14T08:09:11.136Z Last Updated: 2024-08-02T00:48:49.201Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-426 Description: A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-019
CVE ID: CVE-2024-28134 State: PUBLISHED Published: 2024-05-14T08:09:24.900Z Last Updated: 2024-08-02T00:48:49.289Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-319 Description: An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as only non-sensitive information can be obtained but the availability can be seriously a
equired. The access is limited as only non-sensitive information can be obtained but the availability can be seriously affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-019
CVE ID: CVE-2024-28135 State: PUBLISHED Published: 2024-05-14T08:09:39.703Z Last Updated: 2025-01-24T06:35:03.912Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-77 Description: A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-019
CVE ID: CVE-2024-28136 State: PUBLISHED Published: 2024-05-14T08:09:52.725Z Last Updated: 2025-01-24T06:33:52.412Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-77 Description: A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-019
CVE ID: CVE-2024-28137 State: PUBLISHED Published: 2024-05-14T08:10:06.014Z Last Updated: 2024-08-02T00:48:49.163Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-367 Description: A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-019
CVE ID: CVE-2024-28138 State: PUBLISHED Published: 2024-12-10T07:35:06.842Z Last Updated: 2025-11-03T21:54:20.568Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-78 Description: An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28139 State: PUBLISHED Published: 2024-12-11T15:36:49.878Z Last Updated: 2025-11-03T21:54:22.037Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-250 Description: The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess
CVE ID: CVE-2024-28140 State: PUBLISHED Published: 2024-12-11T15:48:22.287Z Last Updated: 2025-11-03T21:54:23.530Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-250 Description: The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the root user. There are also several other applications running as root user. This can be confirmed by running "ps aux" as the root user and observing the output. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28141 State: PUBLISHED Published: 2024-12-11T15:54:38.151Z Last Updated: 2025-11-03T21:54:25.009Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-352 Description: The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the admin password or create new users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportP
- CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28142 State: PUBLISHED Published: 2024-12-12T12:35:15.731Z Last Updated: 2025-11-03T21:54:26.598Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-79 Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page (/cgi/uset.cgi?-cfilename) in the User Settings menu improperly filters the "file name" and wildcard character input field. By exploiting the wildcard character feature, attackers are able to store arbitrary Javascript code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This
ipt code which is being triggered if the page is viewed afterwards, e.g. by higher privileged users such as admins. This attack can even be performed without being logged in because the affected functions are not fully protected. Without logging in, only the file name parameter of the "Default" User can be changed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28143 State: PUBLISHED Published: 2024-12-12T13:52:35.969Z Last Updated: 2025-11-03T21:54:28.078Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-620 Description: The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPorta
E Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28144 State: PUBLISHED Published: 2024-12-12T13:24:16.685Z Last Updated: 2025-11-03T21:54:29.638Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-384 Description: An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28145 State: PUBLISHED Published: 2024-12-12T13:36:34.917Z Last Updated: 2025-11-03T21:54:31.104Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-89 Description: An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter "field" with the UNION keyword. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28146 State: PUBLISHED Published: 2024-12-12T13:49:29.402Z Last Updated: 2025-11-03T21:54:32.579Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-798 Description: The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-28147 State: PUBLISHED Published: 2024-06-20T10:46:41.223Z Last Updated: 2025-02-13T17:47:16.964Z Vendors: metaVentis GmbH Products: edu-sharing Problem Types: CWE-434 Description: An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image (Stored Cross Site Scripting). It is also possible to upload SVG files that include nested XML entities. Those are parsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service a
arsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service attack. This issue affects edu-sharing: <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/metaventis - http://seclists.org/fulldisclosure/2024/Jun/11
CVE ID: CVE-2024-28148 State: PUBLISHED Published: 2024-05-07T13:33:42.137Z Last Updated: 2024-08-02T00:48:49.154Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/n27wlbd05oc6
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo
CVE ID: CVE-2024-28149 State: PUBLISHED Published: 2024-03-06T17:01:53.259Z Last Updated: 2025-02-13T17:47:17.504Z Vendors: Jenkins Project Products: Jenkins HTML Publisher Plugin Description: Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3301 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28150 State: PUBLISHED Published: 2024-03-06T17:01:53.898Z Last Updated: 2025-02-13T17:47:18.356Z Vendors: Jenkins Project Products: Jenkins HTML Publisher Plugin Description: Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3302 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28151 State: PUBLISHED Published: 2024-03-06T17:01:55.535Z Last Updated: 2025-02-13T17:47:18.996Z Vendors: Jenkins Project Products: Jenkins HTML Publisher Plugin Description: Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3303 - http://www.openwall.com/lists/oss-security
ences: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3303 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28152 State: PUBLISHED Published: 2024-03-06T17:01:56.184Z Last Updated: 2025-02-13T17:47:19.640Z Vendors: Jenkins Project Products: Jenkins Bitbucket Branch Source Plugin Description: In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 - http://www.openwall.com/lists/oss-se
References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28153 State: PUBLISHED Published: 2024-03-06T17:01:56.824Z Last Updated: 2025-03-25T16:14:29.682Z Vendors: Jenkins Project Products: Jenkins OWASP Dependency-Check Plugin Description: Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28154 State: PUBLISHED Published: 2024-03-06T17:01:57.449Z Last Updated: 2025-03-27T20:32:25.005Z Vendors: Jenkins Project Products: Jenkins MQ Notifier Plugin Description: Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3180 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28155 State: PUBLISHED Published: 2024-03-06T17:01:58.080Z Last Updated: 2025-03-28T23:32:39.581Z Vendors: Jenkins Project Products: Jenkins AppSpider Plugin Description: Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3144 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28156 State: PUBLISHED Published: 2024-03-06T17:01:58.719Z Last Updated: 2025-03-27T21:10:39.461Z Vendors: Jenkins Project Products: Jenkins Build Monitor View Plugin Description: Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3280 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-28157 State: PUBLISHED Published: 2024-03-06T17:01:59.358Z Last Updated: 2025-02-13T17:47:22.573Z Vendors: Jenkins Project Products: Jenkins GitBucket Plugin Description: Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3249 - http://www.openwall.com/lists/oss-security/2024/03/06/3