Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-24412 State: PUBLISHED Published: 2023-09-01T10:44:49.784Z Last Updated: 2024-09-24T19:07:44.842Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Web-Settler Products: Image Social Feed Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <= 1.7.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add-instagram/wordpress-image-social-feed-plugin-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24413 State: PUBLISHED Published: 2023-08-08T11:28:20.333Z Last Updated: 2024-08-02T10:56:04.125Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: I Thirteen Web Solution Products: WordPress vertical image slider plugin Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin <= 1.2.16 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-vertical-image-slider/wordpress-wordpress-vertical-image-slider-plugin-plugin-1-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24414 State: PUBLISHED Published: 2023-05-20T22:08:55.700Z Last Updated: 2025-01-09T15:13:01.377Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: RoboSoft Products: Photo Gallery, Images, Slider in Rbs Image Gallery Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-11-cross-site-request-forgery-csrf-vulne
o-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-24415 State: PUBLISHED Published: 2023-02-23T15:03:24.804Z Last Updated: 2024-08-02T10:56:04.105Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: QuantumCloud Products: AI ChatBot Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/chatbot/wordpress-chatbot-plugin-4-2-8-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-24416 State: PUBLISHED Published: 2024-02-23T11:32:58.824Z Last Updated: 2024-08-02T10:56:04.275Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Arne Franken Products: All In One Favicon Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/all-in-one-favicon/wordpress-all-in-one-favicon-plugin-4-7-arbitrary-file-deletion-vulnerability?_s_i
base/vulnerability/all-in-one-favicon/wordpress-all-in-one-favicon-plugin-4-7-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-24417 State: PUBLISHED Published: 2023-07-11T12:38:29.231Z Last Updated: 2024-10-07T17:29:07.639Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: tiggersWelt.net Products: Worthy Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in tiggersWelt.Net Worthy plugin <= 1.6.5-6497609 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-worthy/wordpress-worthy-vg-wort-integration-fuer-wordpress-plugin-1-6-5-6497609-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-24418 State: PUBLISHED Published: 2023-05-10T07:43:07.768Z Last Updated: 2025-01-09T15:20:55.905Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Gopi Ramasamy Products: Tiny carousel horizontal slider plus Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tiny-carousel-horizontal-slider-plus/wordpress-tiny-carousel-horizontal-slider-plus-plugin-3-2-cross-site-scripting-xss-vulnerabil
sel-horizontal-slider-plus/wordpress-tiny-carousel-horizontal-slider-plus-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24419 State: PUBLISHED Published: 2023-02-28T13:35:36.994Z Last Updated: 2024-08-02T14:46:32.898Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Strategy11 Form Builder Team Products: Formidable Forms Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/formidable/wordpress-formidable-forms-plugin-5-5-6-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-24420 State: PUBLISHED Published: 2023-06-15T13:32:09.022Z Last Updated: 2024-10-10T18:56:09.376Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Zestard Technologies Products: Admin side data storage for Contact Form 7 Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/admin-side-data-storage-for-contact-form-7/wordpress-admin-side-data-storage-for-contact-form-7-plugin-1-1-1
lnerability/admin-side-data-storage-for-contact-form-7/wordpress-admin-side-data-storage-for-contact-form-7-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24421 State: PUBLISHED Published: 2023-07-11T07:22:25.812Z Last Updated: 2024-10-07T18:21:38.679Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WP Engine Products: PHP Compatibility Checker Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/php-compatibility-checker/wordpress-php-compatibility-checker-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-24422 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:30:51.711Z Vendors: Jenkins Project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016
CVE ID: CVE-2023-24423 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:27:49.805Z Vendors: Jenkins Project Products: Jenkins Gerrit Trigger Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2137
CVE ID: CVE-2023-24424 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:10:57.847Z Vendors: Jenkins Project Products: Jenkins OpenId Connect Authentication Plugin Description: Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2978
CVE ID: CVE-2023-24425 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:10:12.018Z Vendors: Jenkins Project Products: Jenkins Kubernetes Credentials Provider Plugin Description: Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3022
CVE ID: CVE-2023-24426 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:08:32.895Z Vendors: Jenkins Project Products: Jenkins Azure AD Plugin Description: Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2980
CVE ID: CVE-2023-24427 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:25:07.812Z Vendors: Jenkins Project Products: Jenkins Bitbucket OAuth Plugin Description: Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2982
CVE ID: CVE-2023-24428 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:24:00.309Z Vendors: Jenkins Project Products: Jenkins Bitbucket OAuth Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2981
CVE ID: CVE-2023-24429 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:22:13.481Z Vendors: Jenkins Project Products: Jenkins Semantic Versioning Plugin Description: Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkin
st forgery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%281%29
CVE ID: CVE-2023-24430 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:21:38.174Z Vendors: Jenkins Project Products: Jenkins Semantic Versioning Plugin Description: Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%282%29
CVE ID: CVE-2023-24431 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:19:42.068Z Vendors: Jenkins Project Products: Jenkins Orka by MacStadium Plugin Description: A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%281%29
CVE ID: CVE-2023-24432 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:22:45.359Z Vendors: Jenkins Project Products: Jenkins Orka by MacStadium Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%282%29
CVE ID: CVE-2023-24433 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:05:30.865Z Vendors: Jenkins Project Products: Jenkins Orka by MacStadium Plugin Description: Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2772%20%282%29
CVE ID: CVE-2023-24434 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:00:41.744Z Vendors: Jenkins Project Products: Jenkins GitHub Pull Request Builder Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2789%20%282%29
CVE ID: CVE-2023-24435 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:59:08.099Z Vendors: Jenkins Project Products: Jenkins GitHub Pull Request Builder Plugin Description: A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2789%20%282%29
CVE ID: CVE-2023-24436 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:59:55.809Z Vendors: Jenkins Project Products: Jenkins GitHub Pull Request Builder Plugin Description: A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2789%20%281%29
CVE ID: CVE-2023-24437 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:58:25.723Z Vendors: Jenkins Project Products: Jenkins JIRA Pipeline Steps Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2786
CVE ID: CVE-2023-24438 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:57:41.156Z Vendors: Jenkins Project Products: Jenkins JIRA Pipeline Steps Plugin Description: A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2786
CVE ID: CVE-2023-24439 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:56:41.158Z Vendors: Jenkins Project Products: Jenkins JIRA Pipeline Steps Plugin Description: Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774
CVE ID: CVE-2023-24440 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:55:48.139Z Vendors: Jenkins Project Products: Jenkins JIRA Pipeline Steps Plugin Description: Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774
CVE ID: CVE-2023-24441 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:54:26.461Z Vendors: Jenkins Project Products: Jenkins MSTest Plugin Description: Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2292
CVE ID: CVE-2023-24442 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:53:47.113Z Vendors: Jenkins Project Products: Jenkins GitHub Pull Request Coverage Status Plugin Description: Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2767
CVE ID: CVE-2023-24443 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:52:50.343Z Vendors: Jenkins Project Products: Jenkins TestComplete support Plugin Description: Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2741
CVE ID: CVE-2023-24444 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:52:19.949Z Vendors: Jenkins Project Products: Jenkins OpenID Plugin Description: Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2996
CVE ID: CVE-2023-24445 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:51:47.628Z Vendors: Jenkins Project Products: Jenkins OpenID Plugin Description: Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2997
CVE ID: CVE-2023-24446 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:51:02.340Z Vendors: Jenkins Project Products: Jenkins OpenID Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2995
CVE ID: CVE-2023-24447 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:50:19.143Z Vendors: Jenkins Project Products: Jenkins RabbitMQ Consumer Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2778
CVE ID: CVE-2023-24448 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:49:22.986Z Vendors: Jenkins Project Products: Jenkins RabbitMQ Consumer Plugin Description: A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2778
CVE ID: CVE-2023-24449 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:48:38.271Z Vendors: Jenkins Project Products: Jenkins PWauth Security Realm Plugin Description: Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2985
CVE ID: CVE-2023-24450 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T13:47:53.636Z Vendors: Jenkins Project Products: Jenkins view-cloner Plugin Description: Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787