Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typelevel/grackle/security/advisories/GHSA-g56x-7j6w-g8r8 - https://github.com/typelevel/grackle/commit/56e244b91659cf385df590fc6c46695b6f36cbfd - https://github.com/typelevel/grackle/releases/tag/v0.18.0
CVE ID: CVE-2023-50731 State: PUBLISHED Published: 2023-12-22T20:43:18.036Z Last Updated: 2024-08-02T22:16:47.380Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-918 Description: MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directo
tion. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle
ten, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/ - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj - https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/n
HSA-j8w6-2r9h-cxhj - https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125 - https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138
CVE ID: CVE-2023-50732 State: PUBLISHED Published: 2023-12-21T19:42:01.215Z Last Updated: 2024-08-02T22:16:47.254Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-863 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj - https://github.com/xwiki/xwiki-platform/com
://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj - https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3 - https://jira.xwiki.org/browse/XWIKI-20625
CVE ID: CVE-2023-50733 State: PUBLISHED Published: 2025-01-21T22:03:28.688Z Last Updated: 2025-01-22T18:43:36.163Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Lexmark Products: various Problem Types: CWE-918, CWE-20 Description: A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50734 State: PUBLISHED Published: 2024-02-28T01:47:47.211Z Last Updated: 2024-08-23T14:52:38.870Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: various Problem Types: CWE-121 Description: A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50735 State: PUBLISHED Published: 2024-02-28T02:37:26.310Z Last Updated: 2024-08-23T14:55:56.910Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: various Problem Types: CWE-465 Description: A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50736 State: PUBLISHED Published: 2024-02-28T02:37:45.438Z Last Updated: 2024-08-23T14:56:10.517Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: various Problem Types: CWE-131 Description: A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50737 State: PUBLISHED Published: 2024-02-28T02:38:03.334Z Last Updated: 2024-08-23T14:56:24.259Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: various Problem Types: CWE-20 Description: The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50738 State: PUBLISHED Published: 2025-01-17T21:10:44.220Z Last Updated: 2025-01-17T22:02:59.237Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Lexmark Products: Printer Firmware Problem Types: CWE-354, CWE-1328 Description: A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50739 State: PUBLISHED Published: 2025-01-17T23:47:13.923Z Last Updated: 2025-01-22T14:23:31.226Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lexmark Products: Printer Firmware Problem Types: CWE-122 Description: A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2023-50740 State: PUBLISHED Published: 2024-03-06T13:44:53.867Z Last Updated: 2025-02-13T17:19:29.492Z Vendors: Apache Software Foundation Products: Apache Linkis DataSource Problem Types: CWE-532 Description: In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo - http://www.openwall.com/lists/oss-security/2024/03/06/2
CVE ID: CVE-2023-50743 State: PUBLISHED Published: 2024-01-04T14:08:35.684Z Last Updated: 2025-06-03T14:42:37.761Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Online Notice Board System Problem Types: CWE-89 Description: Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/perahia/ - https://www.kashipara.com/
CVE ID: CVE-2023-50752 State: PUBLISHED Published: 2024-01-04T14:09:22.028Z Last Updated: 2024-09-05T14:06:31.662Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Online Notice Board System Problem Types: CWE-89 Description: Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/perahia/ - https://www.kashipara.com/
CVE ID: CVE-2023-50753 State: PUBLISHED Published: 2024-01-04T14:10:29.461Z Last Updated: 2025-06-03T14:42:32.459Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Online Notice Board System Problem Types: CWE-89 Description: Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/perahia/ - https://www.kashipara.co
ontainer: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/perahia/ - https://www.kashipara.com/
CVE ID: CVE-2023-50760 State: PUBLISHED Published: 2024-01-04T14:24:34.938Z Last Updated: 2024-08-26T18:39:38.630Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Online Notice Board System Problem Types: CWE-434 Description: Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'f' parameter of user/update_profile_pic.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/arrau/ - https://www.kashipara.com/
CVE ID: CVE-2023-50761 State: PUBLISHED Published: 2023-12-19T13:38:35.397Z Last Updated: 2025-02-13T17:19:30.089Z Vendors: Mozilla Products: Thunderbird Problem Types: S/MIME signature accepted despite mismatching message date Description: The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. Additional Analyst Not
t a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1865647 - https://www.mozilla.org/security/advisories/mfsa2023-55/ - https://www.debian.org/security/2023/dsa-5582 - https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE ID: CVE-2023-50762 State: PUBLISHED Published: 2023-12-19T13:38:34.261Z Last Updated: 2025-02-13T17:19:30.636Z Vendors: Mozilla Products: Thunderbird Problem Types: Truncated signed text was shown with a valid OpenPGP signature Description: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. Additional Analyst Notes
ommit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1862625 - https://www.mozilla.org/security/advisories/mfsa2023-55/ - https://www.debian.org/security/2023/dsa-5582 - https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
CVE ID: CVE-2023-50763 State: PUBLISHED Published: 2024-06-11T11:15:18.921Z Last Updated: 2024-08-02T22:16:47.270Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-835 Description: A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All
2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of affected products, if configured to allow the import of PKCS12 containers, could end up in an infinite loop when processing incomplete certificate chains. This could allow a
of PKCS12 containers, could end up in an infinite loop when processing incomplete certificate chains. This could allow an authenticated remote attacker to create a denial of service condition by importing specially crafted PKCS12 containers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-139628.html - https://cert-portal.siemens.com/productcert/html/ssa-625862.html - https://cert-portal.siemens.com/productcert/html/ssa-337522.html
CVE ID: CVE-2023-50764 State: PUBLISHED Published: 2023-12-13T17:30:13.658Z Last Updated: 2025-02-13T17:19:31.180Z Vendors: Jenkins Project Products: Jenkins Scriptler Plugin Description: Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3205 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50765 State: PUBLISHED Published: 2023-12-13T17:30:14.297Z Last Updated: 2025-02-13T17:19:31.687Z Vendors: Jenkins Project Products: Jenkins Scriptler Plugin Description: A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3206 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50766 State: PUBLISHED Published: 2023-12-13T17:30:14.962Z Last Updated: 2025-02-13T17:19:32.513Z Vendors: Jenkins Project Products: Jenkins Nexus Platform Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50767 State: PUBLISHED Published: 2023-12-13T17:30:15.589Z Last Updated: 2025-02-13T17:19:33.124Z Vendors: Jenkins Project Products: Jenkins Nexus Platform Plugin Description: Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50768 State: PUBLISHED Published: 2023-12-13T17:30:16.219Z Last Updated: 2025-05-22T18:12:21.589Z Vendors: Jenkins Project Products: Jenkins Nexus Platform Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3203 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50769 State: PUBLISHED Published: 2023-12-13T17:30:16.867Z Last Updated: 2025-02-13T17:19:34.220Z Vendors: Jenkins Project Products: Jenkins Nexus Platform Plugin Description: Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3203 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50770 State: PUBLISHED Published: 2023-12-13T17:30:17.513Z Last Updated: 2025-02-13T17:19:34.765Z Vendors: Jenkins Project Products: Jenkins OpenId Connect Authentication Plugin Description: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 - http://www.openwall.com/lists
tainer: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50771 State: PUBLISHED Published: 2023-12-13T17:30:18.172Z Last Updated: 2025-02-13T17:19:35.345Z Vendors: Jenkins Project Products: Jenkins OpenId Connect Authentication Plugin Description: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50772 State: PUBLISHED Published: 2023-12-13T17:30:18.818Z Last Updated: 2025-02-13T17:19:35.969Z Vendors: Jenkins Project Products: Jenkins Dingding JSON Pusher Plugin Description: Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50773 State: PUBLISHED Published: 2023-12-13T17:30:19.459Z Last Updated: 2025-02-13T17:19:36.476Z Vendors: Jenkins Project Products: Jenkins Dingding JSON Pusher Plugin Description: Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50774 State: PUBLISHED Published: 2023-12-13T17:30:20.085Z Last Updated: 2025-02-13T17:19:37.056Z Vendors: Jenkins Project Products: Jenkins HTMLResource Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3183 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50775 State: PUBLISHED Published: 2023-12-13T17:30:20.742Z Last Updated: 2025-02-13T17:19:37.661Z Vendors: Jenkins Project Products: Jenkins Deployment Dashboard Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3092 - http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE ID: CVE-2023-50776 State: PUBLISHED Published: 2023-12-13T17:30:21.372Z Last Updated: 2025-02-13T17:19:38.180Z Vendors: Jenkins Project Products: Jenkins PaaSLane Estimate Plugin Description: Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182 - http://www.openwall.com/lists/oss-security/2023/12/13/4