Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-32971 State: PUBLISHED Published: 2023-10-06T16:36:19.114Z Last Updated: 2024-09-19T14:44:32.964Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718
versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-37
CVE ID: CVE-2023-32972 State: PUBLISHED Published: 2023-10-06T16:36:33.766Z Last Updated: 2024-09-19T14:40:09.223Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718
CVE ID: CVE-2023-32973 State: PUBLISHED Published: 2023-10-13T19:16:32.872Z Last Updated: 2024-09-16T20:21:50.275Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-120, CWE-121 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718
versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-41
CVE ID: CVE-2023-32974 State: PUBLISHED Published: 2023-10-13T19:16:44.112Z Last Updated: 2024-09-17T16:34:55.421Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later
: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-42
CVE ID: CVE-2023-32975 State: PUBLISHED Published: 2023-12-08T16:07:05.465Z Last Updated: 2025-05-27T14:47:36.100Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later
0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.2.2534 build 20230927 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-07
CVE ID: CVE-2023-32976 State: PUBLISHED Published: 2023-10-13T19:16:54.607Z Last Updated: 2024-09-17T16:14:55.439Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Container Station Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Container Station 2.6.7.44 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-adv
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-44
CVE ID: CVE-2023-32977 State: PUBLISHED Published: 2023-05-16T15:59:58.835Z Last Updated: 2025-01-23T16:06:00.914Z Vendors: Jenkins Project Products: Jenkins Pipeline: Job Plugin Description: Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3042
CVE ID: CVE-2023-32978 State: PUBLISHED Published: 2023-05-16T15:59:59.535Z Last Updated: 2025-01-23T16:05:16.117Z Vendors: Jenkins Project Products: Jenkins LDAP Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3046
CVE ID: CVE-2023-32979 State: PUBLISHED Published: 2023-05-16T16:00:00.471Z Last Updated: 2025-01-23T16:04:34.885Z Vendors: Jenkins Project Products: Jenkins Email Extension Plugin Description: Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on the controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(1)
CVE ID: CVE-2023-32980 State: PUBLISHED Published: 2023-05-16T16:00:01.256Z Last Updated: 2025-01-23T16:02:38.473Z Vendors: Jenkins Project Products: Jenkins Email Extension Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3088%20(2)
CVE ID: CVE-2023-32981 State: PUBLISHED Published: 2023-05-16T16:00:03.102Z Last Updated: 2025-01-23T20:48:15.205Z Vendors: Jenkins Project Products: Jenkins Pipeline Utility Steps Plugin Description: An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196
CVE ID: CVE-2023-32982 State: PUBLISHED Published: 2023-05-16T16:00:04.394Z Last Updated: 2025-01-23T20:44:08.293Z Vendors: Jenkins Project Products: Jenkins Ansible Plugin Description: Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3017
CVE ID: CVE-2023-32983 State: PUBLISHED Published: 2023-05-16T16:00:05.262Z Last Updated: 2025-01-23T20:39:58.216Z Vendors: Jenkins Project Products: Jenkins Ansible Plugin Description: Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3017
CVE ID: CVE-2023-32984 State: PUBLISHED Published: 2023-05-16T16:00:05.973Z Last Updated: 2025-01-23T20:36:38.661Z Vendors: Jenkins Project Products: Jenkins TestNG Results Plugin Description: Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin's test information pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3047
CVE ID: CVE-2023-32985 State: PUBLISHED Published: 2023-05-16T16:00:06.702Z Last Updated: 2025-01-23T20:32:17.164Z Vendors: Jenkins Project Products: Jenkins Sidebar Link Plugin Description: Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3125
CVE ID: CVE-2023-32986 State: PUBLISHED Published: 2023-05-16T16:00:07.514Z Last Updated: 2025-01-23T20:29:53.246Z Vendors: Jenkins Project Products: Jenkins File Parameter Plugin Description: Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3123
CVE ID: CVE-2023-32987 State: PUBLISHED Published: 2023-05-16T16:00:08.216Z Last Updated: 2025-01-23T16:01:46.653Z Vendors: Jenkins Project Products: Jenkins Reverse Proxy Auth Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3002
CVE ID: CVE-2023-32988 State: PUBLISHED Published: 2023-05-16T16:00:08.899Z Last Updated: 2025-01-23T20:25:36.761Z Vendors: Jenkins Project Products: Jenkins Azure VM Agents Plugin Description: A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2855%20(1)
CVE ID: CVE-2023-32989 State: PUBLISHED Published: 2023-05-16T16:00:09.609Z Last Updated: 2025-01-23T20:23:53.348Z Vendors: Jenkins Project Products: Jenkins Azure VM Agents Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2855%20(2)
CVE ID: CVE-2023-32990 State: PUBLISHED Published: 2023-05-16T16:00:10.379Z Last Updated: 2025-01-23T20:16:09.691Z Vendors: Jenkins Project Products: Jenkins Azure VM Agents Plugin Description: A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2855%20(2)
CVE ID: CVE-2023-32991 State: PUBLISHED Published: 2023-05-16T16:00:11.086Z Last Updated: 2025-01-23T20:13:48.072Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2993
CVE ID: CVE-2023-32992 State: PUBLISHED Published: 2023-05-16T16:00:11.790Z Last Updated: 2025-01-23T20:06:44.604Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2993
CVE ID: CVE-2023-32993 State: PUBLISHED Published: 2023-05-16T16:00:12.489Z Last Updated: 2025-01-23T20:00:37.668Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(1)
CVE ID: CVE-2023-32994 State: PUBLISHED Published: 2023-05-16T16:00:13.193Z Last Updated: 2025-01-23T15:59:18.219Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3001%20(2)
CVE ID: CVE-2023-32995 State: PUBLISHED Published: 2023-05-16T16:00:13.896Z Last Updated: 2025-01-23T19:57:01.610Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2994
CVE ID: CVE-2023-32996 State: PUBLISHED Published: 2023-05-16T16:00:14.596Z Last Updated: 2025-01-23T19:53:31.647Z Vendors: Jenkins Project Products: Jenkins SAML Single Sign On(SSO) Plugin Description: A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2994
CVE ID: CVE-2023-32997 State: PUBLISHED Published: 2023-05-16T16:00:15.315Z Last Updated: 2025-01-23T15:57:28.000Z Vendors: Jenkins Project Products: Jenkins CAS Plugin Description: Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3000
CVE ID: CVE-2023-32998 State: PUBLISHED Published: 2023-05-16T16:00:16.022Z Last Updated: 2025-01-23T15:56:22.413Z Vendors: Jenkins Project Products: Jenkins AppSpider Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3121
CVE ID: CVE-2023-32999 State: PUBLISHED Published: 2023-05-16T16:00:16.703Z Last Updated: 2025-01-23T15:54:45.686Z Vendors: Jenkins Project Products: Jenkins AppSpider Plugin Description: A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3121
CVE ID: CVE-2023-33000 State: PUBLISHED Published: 2023-05-16T16:00:17.398Z Last Updated: 2025-01-23T15:52:11.359Z Vendors: Jenkins Project Products: Jenkins NS-ND Integration Performance Publisher Plugin Description: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2962
CVE ID: CVE-2023-33001 State: PUBLISHED Published: 2023-05-16T16:00:18.099Z Last Updated: 2025-01-23T15:50:41.687Z Vendors: Jenkins Project Products: Jenkins HashiCorp Vault Plugin Description: Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3077
CVE ID: CVE-2023-33002 State: PUBLISHED Published: 2023-05-16T16:00:18.784Z Last Updated: 2025-01-23T15:48:59.468Z Vendors: Jenkins Project Products: Jenkins TestComplete support Plugin Description: Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2892
CVE ID: CVE-2023-33003 State: PUBLISHED Published: 2023-05-16T16:00:19.486Z Last Updated: 2025-01-23T15:46:50.541Z Vendors: Jenkins Project Products: Jenkins Tag Profiler Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3083
CVE ID: CVE-2023-33004 State: PUBLISHED Published: 2023-05-16T16:00:20.189Z Last Updated: 2025-01-23T15:45:16.505Z Vendors: Jenkins Project Products: Jenkins Tag Profiler Plugin Description: A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3083
CVE ID: CVE-2023-33005 State: PUBLISHED Published: 2023-05-16T16:00:20.871Z Last Updated: 2025-01-23T15:38:06.819Z Vendors: Jenkins Project Products: Jenkins WSO2 Oauth Plugin Description: Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2991
CVE ID: CVE-2023-33006 State: PUBLISHED Published: 2023-05-16T16:00:21.568Z Last Updated: 2025-01-23T15:34:50.994Z Vendors: Jenkins Project Products: Jenkins WSO2 Oauth Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2990
CVE ID: CVE-2023-33007 State: PUBLISHED Published: 2023-05-16T16:00:22.256Z Last Updated: 2025-01-23T15:31:41.743Z Vendors: Jenkins Project Products: Jenkins LoadComplete support Plugin Description: Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2903
CVE ID: CVE-2023-33008 State: PUBLISHED Published: 2023-07-07T09:07:31.070Z Last Updated: 2024-10-07T19:13:58.440Z Vendors: Apache Software Foundation Products: Apache Johnzon Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: throu