Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000408 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1128 - http://www.securit
CVE Program Container: References: - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1128 - http://www.securityfocus.com/bid/106532
CVE ID: CVE-2018-1000409 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1158
CVE ID: CVE-2018-1000410 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.secu
on could not be successfully processed. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-10-10/#SECURITY-765
CVE ID: CVE-2018-1000411 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1101 - http://www.securityfocus.com/bid/106532
CVE ID: CVE-2018-1000412 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1029 - http://www.securityfocus.com/bid/106532
CVE ID: CVE-2018-1000413 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080
CVE ID: CVE-2018-1000414 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-938
CVE ID: CVE-2018-1000415 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly, RebuildAction/ListSubversionTagsParameterValue.jelly, RebuildAction/MavenMetadataParameterValue.jelly, RebuildAction/NodeParameterValue.jelly, RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterVa
RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterValue.jelly, RebuildAction/StringParameterValue.jelly, RebuildAction/TextParameterValue.jelly, RebuildAction/ValidatingStringParameterValue.jelly that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-130
CVE ID: CVE-2018-1000416 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1130 - http://www.securityfocus.com/bid/106532
CVE ID: CVE-2018-1000417 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1125
CVE ID: CVE-2018-1000418 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%281%29
CVE ID: CVE-2018-1000419 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%282%29
CVE ID: CVE-2018-1000420 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%281%29
CVE ID: CVE-2018-1000421 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%282%29
CVE ID: CVE-2018-1000422 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1067
CVE ID: CVE-2018-1000423 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1068
CVE ID: CVE-2018-1000424 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265
CVE ID: CVE-2018-1000425 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:46.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1163
CVE ID: CVE-2018-1000426 State: PUBLISHED Published: 2019-01-09T23:00:00 Last Updated: 2024-08-05T12:40:47.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.
itional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106532 - https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1122
CVE ID: CVE-2018-1000500 State: PUBLISHED Published: 2018-06-26T16:00:00.000Z Last Updated: 2025-06-09T15:31:44.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://lists.busybox.net/pipermail/busybox/2018-May/086462.html - https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb
permail/busybox/2018-May/086462.html - https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91 - https://usn.ubuntu.com/4531-1/
CVE ID: CVE-2018-1000501 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3. Additional Analyst Notes: - CVE Program Container: References: - http://my.instant-update.com/t/i-wanna-to-report-an-security-issue/659/3 - https://github.com/InstantUpdate/CMS/commit/5e70496b6b0c4cd554e62a709a248c1584533da6
CVE ID: CVE-2018-1000502 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP versions. This attack appear to be exploitable via Must have access to admin panel. This vulnerability appears to have been fixed in 1.8.15. Additional Analyst Notes: - CVE Program Container: References: - http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html - https://bl
E Program Container: References: - http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html - https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/
CVE ID: CVE-2018-1000503 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15. Additional Analyst Notes: - CVE Program Container: References: - http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html - https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/
CVE ID: CVE-2018-1000504 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerability appears to have been fixed in 2.8. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/ace-file-inclusion-redirection/
CVE ID: CVE-2018-1000505 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/csrf-in-tooltipy/
CVE ID: CVE-2018-1000506 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-manager that can result in allows anybody to do almost anything an admin can. This attack appear to be exploitable via Logged in user must follow a link. This vulnerability appears to have been fixed in 1.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/csrf-metronet-tag-manager/
CVE ID: CVE-2018-1000507 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to modify user groups and types. This attack appear to be exploitable via Admin must click on link. This vulnerability appears to have been fixed in 2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/csrf-wp-user-groups/
CVE ID: CVE-2018-1000508 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/stored-xss-wp-ulike/
CVE ID: CVE-2018-1000509 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be exploitable via Attacker must have access to admin account. This vulnerability appears to have been fixed in 2.8. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/unserialization-redirection/
CVE ID: CVE-2018-1000510 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. This attack appear to be exploitable via Can be triggered intentionally (or unintentionally via CSRF) by any logged in user. This vulnerability appears to have been fixed in 1.24. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/wp-image-zoom-dos/
CVE ID: CVE-2018-1000511 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/wp-ulike-delete-rows/
CVE ID: CVE-2018-1000512 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.dxw.com/advisories/xss-in-tooltipy/
CVE ID: CVE-2018-1000513 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=13560
CVE ID: CVE-2018-1000514 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This vulnerability appears to have been fixed in 3.6.x. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.limesurvey.org/view.php?id=13562 - https://bugs.limesurvey.org/plugin.php?page=Source/view&id=26925
CVE ID: CVE-2018-1000515 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that can result in Attacker can read any file in the server or use smbrelay attack to access to server.. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1P7djpYX8VQ0oplhOCMFNdKQByCcw2ncU?usp=sharing
CVE ID: CVE-2018-1000516 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T12:40:47.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear
icious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01. Additional Analyst Notes: - CVE Program Container: References: - https://galaxyproject.org/archive/dev-news-briefs/2015-01-13/#security