Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-30886 State: PUBLISHED Published: 2022-05-20T12:53:22 Last Updated: 2024-08-03T07:03:39.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_report.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/167001/School-Dormitory-Management-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-30887 State: PUBLISHED Published: 2022-05-20T12:53:21 Last Updated: 2024-08-03T07:03:38.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/166786/Pharmacy-Management-System-1.0-Shell-Upload.html
CVE ID: CVE-2022-30898 State: PUBLISHED Published: 2022-06-09T18:52:44 Last Updated: 2024-08-03T07:03:39.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chshcms/cscms/issues/37
CVE ID: CVE-2022-30899 State: PUBLISHED Published: 2022-06-08T15:51:24 Last Updated: 2024-08-03T07:03:38.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/partkeepr/PartKeepr/issues/1240
CVE ID: CVE-2022-30903 State: PUBLISHED Published: 2022-06-14T17:02:37 Last Updated: 2024-08-03T07:03:38.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting (XSS) via the admin->Maintenance>Device Management. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40shubhamvpandey/xss-found-in-nokia-g-2425g-a-home-wifi-router-f4fae083ed97 - https://youtu.be/CxBo_gQffOY
CVE ID: CVE-2022-30904 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:34:10.012Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/1is3dYwMcRIkhjvujzi5OgnaGBsQVtlew/edit
CVE ID: CVE-2022-30909 State: PUBLISHED Published: 2022-06-08T13:23:50 Last Updated: 2024-08-03T07:03:39.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/3
CVE ID: CVE-2022-30910 State: PUBLISHED Published: 2022-06-08T13:23:51 Last Updated: 2024-08-03T07:03:39.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/1
CVE ID: CVE-2022-30912 State: PUBLISHED Published: 2022-06-08T13:23:52 Last Updated: 2024-08-03T07:03:39.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/4
CVE ID: CVE-2022-30913 State: PUBLISHED Published: 2022-06-08T13:23:53 Last Updated: 2024-08-03T07:03:39.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos_set_bandwidth parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/7
CVE ID: CVE-2022-30914 State: PUBLISHED Published: 2022-06-08T13:23:54 Last Updated: 2024-08-03T07:03:38.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/5
CVE ID: CVE-2022-30915 State: PUBLISHED Published: 2022-06-08T13:23:54 Last Updated: 2024-08-03T07:03:38.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/6
CVE ID: CVE-2022-30916 State: PUBLISHED Published: 2022-06-08T13:23:55 Last Updated: 2024-08-03T07:03:39.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/9
CVE ID: CVE-2022-30917 State: PUBLISHED Published: 2022-06-08T13:23:56 Last Updated: 2024-08-03T07:03:39.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/10
CVE ID: CVE-2022-30918 State: PUBLISHED Published: 2022-06-08T13:23:59 Last Updated: 2024-08-03T07:03:39.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/8
CVE ID: CVE-2022-30919 State: PUBLISHED Published: 2022-06-08T13:23:58 Last Updated: 2024-08-03T07:03:39.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/13
CVE ID: CVE-2022-30920 State: PUBLISHED Published: 2022-06-08T13:24:00 Last Updated: 2024-08-03T07:03:39.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/12
CVE ID: CVE-2022-30921 State: PUBLISHED Published: 2022-06-08T13:24:01 Last Updated: 2024-08-03T07:03:39.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/14
CVE ID: CVE-2022-30922 State: PUBLISHED Published: 2022-06-08T13:24:02 Last Updated: 2024-08-03T07:03:39.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/11
CVE ID: CVE-2022-30923 State: PUBLISHED Published: 2022-06-08T13:24:02 Last Updated: 2024-08-03T07:03:40.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/16
CVE ID: CVE-2022-30924 State: PUBLISHED Published: 2022-06-08T13:24:03 Last Updated: 2024-08-03T07:03:39.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/15
CVE ID: CVE-2022-30925 State: PUBLISHED Published: 2022-06-08T13:24:04 Last Updated: 2024-08-03T07:03:39.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/17
CVE ID: CVE-2022-30926 State: PUBLISHED Published: 2022-06-08T13:24:05 Last Updated: 2024-08-03T07:03:39.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/EPhaha/IOT_vuln/tree/main/H3C/magicR100/18
CVE ID: CVE-2022-30927 State: PUBLISHED Published: 2022-06-06T22:10:40 Last Updated: 2024-08-03T07:03:39.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable "id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15328/simple-task-scheduler-system-phpoop-free-source-code.html - https://www.sourcecodester.com/sites/default/files/download/oretnom23/tss.zip - https://github.com/ykosan1/Simple-Task-Scheduling-System-id-S
ester.com/sites/default/files/download/oretnom23/tss.zip - https://github.com/ykosan1/Simple-Task-Scheduling-System-id-SQL-Injection-Unauthenticated
CVE ID: CVE-2022-30929 State: PUBLISHED Published: 2022-07-06T14:21:59 Last Updated: 2024-08-03T07:03:39.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. Additional Analyst Notes: - CVE Program Container: References: - https://t.me/WangPanBOT?start=file96eb2dc53cc57847 - https://github.com/AgainstTheLight/CVE-2022-30929
CVE ID: CVE-2022-30930 State: PUBLISHED Published: 2022-06-14T16:08:42 Last Updated: 2024-08-03T07:03:39.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://www.acunetix.com/vulnerabilities/web/possible-csrf-cross-site-request-forgery/ - https://medium.com/%40pmmali/my-second-cve-2022-30930-4f9aab047518
CVE ID: CVE-2022-30931 State: PUBLISHED Published: 2022-06-14T15:45:45 Last Updated: 2024-08-03T07:03:39.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.acunetix.com/vulnerabilities/web/possible-csrf-cross-site-request-forgery/ - https://medium.com/%40niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba
CVE ID: CVE-2022-30932 State: REJECTED Published: 2022-06-26T18:54:26 Last Updated: 2022-06-26T18:54:26 Description: No description available.
CVE ID: CVE-2022-30935 State: PUBLISHED Published: 2022-09-28T10:24:56.000Z Last Updated: 2025-05-21T13:51:50.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b2e
s well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b2evolution/b2evolution/blob/master/inc/_core/_misc.funcs.php#L5955 - https://github.com/b2evolution/b2evolution/issues/114 - https://b2evolution.net/downloads/7-2-5-stable
CVE ID: CVE-2022-30937 State: PUBLISHED Published: 2022-06-14T09:21:54 Last Updated: 2024-08-03T07:03:39.594Z Vendors: Siemens Products: EN100 Ethernet module DNP3 IP variant, EN100 Ethernet module IEC 104 variant, EN100 Ethernet module IEC 61850 variant, EN100 Ethernet module Modbus TCP variant, EN100 Ethernet module PROFINET IO variant Problem Types: CWE-119 Description: A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions)
4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf
CVE ID: CVE-2022-30938 State: PUBLISHED Published: 2022-07-12T10:06:41 Last Updated: 2024-08-03T07:03:39.678Z Vendors: Siemens Products: EN100 Ethernet module DNP3 IP variant, EN100 Ethernet module IEC 104 variant, EN100 Ethernet module IEC 61850 variant, EN100 Ethernet module Modbus TCP variant, EN100 Ethernet module PROFINET IO variant Problem Types: CWE-119 Description: A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions)
4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint manupulating a specific argument. This could allow an attacker to crash the affected application leading to a denial of service condition Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-865333.pdf
CVE ID: CVE-2022-30943 State: PUBLISHED Published: 2022-07-11T00:40:24 Last Updated: 2024-08-03T07:03:40.052Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Access Control Description: Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data of Bulletin. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007682.html - https://jvn.jp/en/jp/JVN14077132/index.html
CVE ID: CVE-2022-30944 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:17:13.227Z Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: information disclosure Description: Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html - https://security.netapp.com/advisory/ntap-20221014-0004/
CVE ID: CVE-2022-30945 State: PUBLISHED Published: 2022-05-17T14:05:37 Last Updated: 2024-08-03T07:03:40.031Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30946 State: PUBLISHED Published: 2022-05-17T14:05:52 Last Updated: 2024-08-03T07:03:39.447Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30947 State: PUBLISHED Published: 2022-05-17T14:06:05 Last Updated: 2024-08-03T07:03:40.003Z Vendors: Jenkins project Products: Jenkins Git Plugin Description: Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30948 State: PUBLISHED Published: 2022-05-17T14:06:07 Last Updated: 2024-08-03T07:03:39.392Z Vendors: Jenkins project Products: Jenkins Mercurial Plugin Description: Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30949 State: PUBLISHED Published: 2022-05-17T14:06:09 Last Updated: 2024-08-03T07:03:39.748Z Vendors: Jenkins project Products: Jenkins REPO Plugin Description: Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30950 State: PUBLISHED Published: 2022-05-17T14:06:12 Last Updated: 2024-08-03T07:03:39.989Z Vendors: Jenkins project Products: Jenkins WMI Windows Agents Plugin Description: Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30951 State: PUBLISHED Published: 2022-05-17T14:06:14 Last Updated: 2024-08-03T07:03:39.955Z Vendors: Jenkins project Products: Jenkins WMI Windows Agents Plugin Description: Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2604 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30952 State: PUBLISHED Published: 2022-05-17T00:00:00 Last Updated: 2024-08-03T07:03:39.865Z Vendors: Jenkins project Products: Jenkins Pipeline SCM API for Blue Ocean Plugin Description: Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30953 State: PUBLISHED Published: 2022-05-17T14:06:18 Last Updated: 2024-08-03T07:03:39.866Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30954 State: PUBLISHED Published: 2022-05-17T14:06:21 Last Updated: 2024-08-03T07:03:40.035Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugin Description: Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502 - http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE ID: CVE-2022-30955 State: PUBLISHED Published: 2022-05-17T14:06:23 Last Updated: 2024-08-03T07:03:39.911Z Vendors: Jenkins project Products: Jenkins GitLab Plugin Description: Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2753