Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
5j6-p5cj-5hh5 - https://github.com/nextcloud/richdocuments/pull/2604 - https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings
CVE ID: CVE-2023-28646 State: PUBLISHED Published: 2023-03-30T18:16:18.917Z Last Updated: 2025-02-11T18:56:24.113Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-287, CWE-281 Description: Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to
information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3rf-94h6-vj8v - https://github.com/nextcloud/android/pull/11242
CVE ID: CVE-2023-28647 State: PUBLISHED Published: 2023-03-30T18:12:25.312Z Last Updated: 2025-02-11T18:57:19.268Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-281, CWE-287 Description: Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds
ess to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6 - https://github.com/nextcloud/ios/pull/2344
CVE ID: CVE-2023-28648 State: PUBLISHED Published: 2023-03-28T20:06:56.715Z Last Updated: 2025-01-16T21:38:05.808Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ProPump and Controls, Inc. Products: Osprey Pump Controller Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
r session in context of an affected site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CVE ID: CVE-2023-28649 State: PUBLISHED Published: 2023-05-22T19:10:51.219Z Last Updated: 2025-01-16T21:34:03.865Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Snap One Products: OvrC Cloud Problem Types: CWE-413 Description: The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
found devices are already managed by another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01 - https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf
CVE ID: CVE-2023-28650 State: PUBLISHED Published: 2023-03-27T19:40:04.111Z Last Updated: 2025-01-17T17:17:52.267Z Vendors: SAUTER Products: EY-AS525F001 with moduWeb Problem Types: CWE-79 Cross-site Scripting Description: An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE ID: CVE-2023-28651 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T20:52:29.606Z Vendors: Contec Co., Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/api/d
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - https://jvn.jp/en/vu/JVNVU93372935/
CVE ID: CVE-2023-28652 State: PUBLISHED Published: 2023-03-27T19:29:45.917Z Last Updated: 2025-01-17T17:38:34.744Z Vendors: SAUTER Products: EY-AS525F001 with moduWeb Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE ID: CVE-2023-28653 State: PUBLISHED Published: 2023-06-06T16:42:49.346Z Last Updated: 2025-01-07T18:34:18.182Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-416 Description: The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-after-free vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa
CVE ID: CVE-2023-28654 State: PUBLISHED Published: 2023-03-28T20:03:03.238Z Last Updated: 2025-01-16T21:38:27.722Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProPump and Controls, Inc. Products: Osprey Pump Controller Problem Types: CWE-259 Use of Hard-Coded Password Description: Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device. Additional Analyst Notes: - CVE Program Cont
the password cannot be changed through any normal operation of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CVE ID: CVE-2023-28655 State: PUBLISHED Published: 2023-03-27T19:38:44.049Z Last Updated: 2025-01-17T17:34:32.909Z Vendors: SAUTER Products: EY-AS525F001 with moduWeb Problem Types: CWE-79 Cross-site Scripting Description: A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE ID: CVE-2023-28656 State: PUBLISHED Published: 2023-05-03T14:34:11.577Z Last Updated: 2025-02-13T16:48:48.509Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: NGINX Instance Manager, NGINX API Connectivity Manager, NGINX Security Monitoring Problem Types: CWE-639 Description: NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000133417 - http
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000133417 - https://security.netapp.com/advisory/ntap-20230609-0006/
CVE ID: CVE-2023-28657 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:32:38.643Z Vendors: Contec Co., Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: Improper access control Description: Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained and/or altered by the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_
hment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - https://jvn.jp/en/vu/JVNVU93372935/
CVE ID: CVE-2023-28658 State: PUBLISHED Published: 2023-08-11T02:37:14.703Z Last Updated: 2024-10-15T17:55:57.065Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneMKL software Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00873.html
CVE ID: CVE-2023-28659 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T20:45:09.755Z Vendors: n/a Products: Waiting: One-click Countdowns WordPress Plugin Problem Types: Authenticated SQL Injection Description: The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-2
CVE ID: CVE-2023-28660 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T16:02:29.430Z Vendors: n/a Products: Events Made Easy WordPress Plugin Problem Types: Authenticated SQL Injection Description: The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-2
CVE ID: CVE-2023-28661 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T16:01:35.724Z Vendors: n/a Products: WP Popup Banners WordPress Plugin Problem Types: Authenticated SQL Injection Description: The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-2
CVE ID: CVE-2023-28662 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T20:42:16.787Z Vendors: n/a Products: Gift Cards (Gift Vouchers and Packages) WordPress Plugin Problem Types: Unauthenticated SQL Injection Description: The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-2
CVE ID: CVE-2023-28663 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T20:39:25.987Z Vendors: n/a Products: Formidable PRO2PDF WordPress Plugin Problem Types: Authenticated SQL Injection Description: The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-2
CVE ID: CVE-2023-28664 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T21:07:25.642Z Vendors: n/a Products: Meta Data and Taxonomies Filter WordPress Plugin Problem Types: Authenticated Reflected Cross-Site Scripting Description: The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-3
CVE ID: CVE-2023-28665 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T19:13:42.584Z Vendors: n/a Products: Woo Bulk Price Update WordPress Plugin Problem Types: Authenticated Reflected Cross-Site Scripting Description: The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-3
CVE ID: CVE-2023-28666 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T21:00:40.626Z Vendors: n/a Products: InPost Gallery WordPress Plugin Problem Types: Authenticated Reflected Cross-Site Scripting Description: The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-3
CVE ID: CVE-2023-28667 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-25T18:47:30.275Z Vendors: n/a Products: Lead Generated WordPress Plugin Problem Types: Deserialization of Untrusted Data Description: The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is
ass implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-7
CVE ID: CVE-2023-28668 State: PUBLISHED Published: 2023-03-23T11:25:59.292Z Last Updated: 2025-02-25T19:23:04.370Z Vendors: Jenkins Project Products: Jenkins Role-based Authorization Strategy Plugin Description: Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3053
CVE ID: CVE-2023-28669 State: PUBLISHED Published: 2023-03-23T11:26:00.146Z Last Updated: 2025-02-25T19:21:31.567Z Vendors: Jenkins Project Products: Jenkins JaCoCo Plugin Description: Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3061
CVE ID: CVE-2023-28670 State: PUBLISHED Published: 2023-03-23T11:26:00.852Z Last Updated: 2025-02-25T21:01:15.828Z Vendors: Jenkins Project Products: Jenkins Pipeline Aggregator View Plugin Description: Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2885
CVE ID: CVE-2023-28671 State: PUBLISHED Published: 2023-03-23T11:26:01.646Z Last Updated: 2025-02-25T20:10:22.258Z Vendors: Jenkins Project Products: Jenkins OctoPerf Load Testing Plugin Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(1)
CVE ID: CVE-2023-28672 State: PUBLISHED Published: 2023-03-23T11:26:02.427Z Last Updated: 2025-02-25T20:08:41.612Z Vendors: Jenkins Project Products: Jenkins OctoPerf Load Testing Plugin Plugin Description: Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067
ram Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(2)
CVE ID: CVE-2023-28673 State: PUBLISHED Published: 2023-03-23T11:26:03.128Z Last Updated: 2024-08-02T13:43:23.657Z Vendors: Jenkins Project Products: Jenkins OctoPerf Load Testing Plugin Plugin Description: A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(3)
CVE ID: CVE-2023-28674 State: PUBLISHED Published: 2023-03-23T11:26:03.841Z Last Updated: 2025-02-25T20:16:45.308Z Vendors: Jenkins Project Products: Jenkins OctoPerf Load Testing Plugin Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(4)
CVE ID: CVE-2023-28675 State: PUBLISHED Published: 2023-03-23T11:26:04.539Z Last Updated: 2025-02-25T19:01:03.541Z Vendors: Jenkins Project Products: Jenkins OctoPerf Load Testing Plugin Plugin Description: A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-3067%20(4)
CVE ID: CVE-2023-28676 State: PUBLISHED Published: 2023-03-23T11:26:05.301Z Last Updated: 2025-02-25T19:19:58.214Z Vendors: Jenkins Project Products: Jenkins Convert To Pipeline Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2963
CVE ID: CVE-2023-28677 State: PUBLISHED Published: 2023-03-23T11:26:06.014Z Last Updated: 2025-02-25T19:17:43.562Z Vendors: Jenkins Project Products: Jenkins Convert To Pipeline Plugin Description: Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
rom a convertion by Jenkins Convert To Pipeline Plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2966
CVE ID: CVE-2023-28678 State: PUBLISHED Published: 2023-03-23T11:26:06.733Z Last Updated: 2025-02-25T19:16:28.695Z Vendors: Jenkins Project Products: Jenkins Cppcheck Plugin Description: Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2809