deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2313
Published: 2022-07-27
Description: A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-427
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10385&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US; https://kcm.trellix.com/corporate/index?page=content&id=SB10385&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US
CVE: CVE-2022-23099
Published: 2022-07-27
Description: OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2022/Jul/11; https://open-xchange.com
CVE: CVE-2022-23100
Published: 2022-07-27
Description: OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2022/Jul/11; https://open-xchange.com
CVE: CVE-2022-23101
Published: 2022-07-27
Description: OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2022/Jul/11; https://open-xchange.com
CVE: CVE-2022-24405
Published: 2022-07-27
Description: OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2022/Jul/11; https://open-xchange.com
CVE: CVE-2022-24406
Published: 2022-07-27
Description: OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2022/Jul/11; https://open-xchange.com
CVE: CVE-2022-33970
Published: 2022-07-27
Description: Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-1-2-authenticated-wordpress-options-change-vulnerability; https://wordpress.org/plugins/shortcode-addons/#developers; https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-1-2-authenticated-wordpress-options-change-vulnerability
CVE: CVE-2022-34529
Published: 2022-07-27
Description: WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/wasm3/wasm3/issues/337; https://github.com/wasm3/wasm3/issues/337
CVE: CVE-2022-34549
Published: 2022-07-27
Description: Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate privileges and execute arbitrary commands via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://cwe.mitre.org/data/definitions/434.html; https://github.com/rawchen/sims/issues/6; http://cwe.mitre.org/data/definitions/434.html
CVE: CVE-2022-34550
Published: 2022-07-27
Description: Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://cwe.mitre.org/data/definitions/79.html; https://github.com/rawchen/sims/issues/8; http://cwe.mitre.org/data/definitions/79.html
CVE: CVE-2022-34551
Published: 2022-07-27
Description: Sims v1.0 was discovered to allow path traversal when downloading attachments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://cwe.mitre.org/data/definitions/23.html; https://github.com/rawchen/sims/issues/7; http://cwe.mitre.org/data/definitions/23.html
CVE: CVE-2022-35291
Published: 2022-07-27
Description: Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://launchpad.support.sap.com/#/notes/3226411; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3226411
CVE: CVE-2022-2549
Published: 2022-07-27
Description: NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/0102c5d4db7fdbf08b5b591b2a6264de33867a07; https://huntr.dev/bounties/c93083dc-177c-4ba0-ba83-9d7fb29a5537; https://github.com/gpac/gpac/commit/0102c5d4db7fdbf08b5b591b2a6264de33867a07
CVE: CVE-2022-2550
Published: 2022-07-27
Description: OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/hestiacp/hestiacp/commit/3d4c309cf138943cfd1e71ae[PII_REDACTED]7aa4bf; https://huntr.dev/bounties/6ab4384d-bcbe-4d98-bf67-35c3535fc5c7; https://github.com/hestiacp/hestiacp/commit/3d4c309cf138943cfd1e71ae[PII_REDACTED]7aa4bf
CVE: CVE-2022-36881
Published: 2022-07-27
Description: Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36882
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36883
Published: 2022-07-27
Description: A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36884
Published: 2022-07-27
Description: The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36885
Published: 2022-07-27
Description: Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36886
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of an external job.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2762; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36887
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2766; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36888
Published: 2022-07-27
Description: A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2593; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36889
Published: 2022-07-27
Description: Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2764; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36890
Published: 2022-07-27
Description: Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2206; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36891
Published: 2022-07-27
Description: A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2205; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36892
Published: 2022-07-27
Description: Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2402; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36893
Published: 2022-07-27
Description: Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2403; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36894
Published: 2022-07-27
Description: An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2413; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36895
Published: 2022-07-27
Description: A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2619; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36896
Published: 2022-07-27
Description: A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2621; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36897
Published: 2022-07-27
Description: A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2626; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36898
Published: 2022-07-27
Description: A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2628; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36899
Published: 2022-07-27
Description: Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
CVSS Score: 8.2 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2629; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36900
Published: 2022-07-27
Description: Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
CVSS Score: 8.2 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2630; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36901
Published: 2022-07-27
Description: Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2053; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36902
Published: 2022-07-27
Description: Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2682; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36903
Published: 2022-07-27
Description: A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2665%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36904
Published: 2022-07-27
Description: Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2665%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36905
Published: 2022-07-27
Description: Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36906
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36907
Published: 2022-07-27
Description: A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36908
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36909
Published: 2022-07-27
Description: A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1375%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36910
Published: 2022-07-27
Description: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2048; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36911
Published: 2022-07-27
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2105%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36912
Published: 2022-07-27
Description: A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2105%20%281%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36913
Published: 2022-07-27
Description: Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2105%20%282%29; http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE: CVE-2022-36914
Published: 2022-07-27
Description: Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/07/27/1; https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2210; http://www.openwall.com/lists/oss-security/2022/07/27/1