deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-28773
Published: 2022-04-12
Description: Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: https://launchpad.support.sap.com/#/notes/3111293; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3111293
CVE: CVE-2022-28795
Published: 2022-04-12
Description: A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.
CVSS Score: 6.5 (MEDIUM)
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2021-28544
Published: 2022-04-12
Description: Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://seclists.org/fulldisclosure/2022/Jul/18; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/
CVE: CVE-2022-22549
Published: 2022-04-12
Description: Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability, leading to a man-in-the-middle capture of administrative credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000195815/dsa-2022-002-dell-emc-powerscale-onefs-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000195815/dsa-2022-002-dell-emc-powerscale-onefs-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-22550
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local attacker could potentially exploit this vulnerability, leading to account take over.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-549, CWE-522
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-22559
Published: 2022-04-12
Description: Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerability, leading to the potential for information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-22560
Published: 2022-04-12
Description: Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user to the backend ethernet switch of a PowerScale cluster. The attacker can exploit this vulnerability to take the switch offline.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-22561
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307, CWE-307
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-22562
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. An unauthenticated network attacker could potentially exploit this denial-of-service vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-229
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-22565
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user could potentially exploit this vulnerability, leading to disclosure or modification of sensitive data.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-612
References: https://www.dell.com/support/kbdoc/000195815; https://www.dell.com/support/kbdoc/000195815
CVE: CVE-2022-23159
Published: 2022-04-12
Description: Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_AUTH_PROVIDERS privileges could exploit this vulnerability, leading to a Denial-Of-Service. This can also impact a cluster in Compliance mode. Dell recommends to update at the earliest opportunity.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://www.dell.com/support/kbdoc/000196009; https://www.dell.com/support/kbdoc/000196009
CVE: CVE-2022-23160
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentially exploit this vulnerability, leading to gaining write permissions on read-only files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-274, CWE-269
References: https://www.dell.com/support/kbdoc/000196009; https://www.dell.com/support/kbdoc/000196009
CVE: CVE-2022-23161
Published: 2022-04-12
Description: Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially exploit this vulnerability, leading to denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://www.dell.com/support/kbdoc/000196009; https://www.dell.com/support/kbdoc/000196009
CVE: CVE-2022-23163
Published: 2022-04-12
Description: Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vulnerability, leading to denial of service/data unavailability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-379, CWE-668
References: https://www.dell.com/support/kbdoc/000196009; https://www.dell.com/support/kbdoc/000196009
CVE: CVE-2022-24070
Published: 2022-04-12
Description: Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2022/Jul/18; https://bz.apache.org/bugzilla/show_bug.cgi?id=65861; https://cwiki.apache.org/confluence/display/HTTPD/ModuleLife
CVE: CVE-2022-24411
Published: 2022-04-12
Description: Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. This could potentially allow users to circumvent PowerScale Compliance Mode guarantees.
CVSS Score: 7.8 (HIGH)
CWE: CWE-378, CWE-668
References: https://www.dell.com/support/kbdoc/000196657; https://www.dell.com/support/kbdoc/000196657
CVE: CVE-2022-24412
Published: 2022-04-12
Description: Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-229
References: https://www.dell.com/support/kbdoc/000196657; https://www.dell.com/support/kbdoc/000196657
CVE: CVE-2022-24413
Published: 2022-04-12
Description: Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesystem could potentially exploit this vulnerability, leading to data loss.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://www.dell.com/support/kbdoc/000196657; https://www.dell.com/support/kbdoc/000196657
CVE: CVE-2022-24765
Published: 2022-04-12
Description: Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-427
References: http://seclists.org/fulldisclosure/2022/May/31; http://www.openwall.com/lists/oss-security/2022/04/12/7; https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash
CVE: CVE-2022-24767
Published: 2022-04-12
Description: GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767
CVE: CVE-2022-24842
Published: 2022-04-12
Description: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3; https://github.com/minio/minio/pull/14729; https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q
CVE: CVE-2022-0915
Published: 2022-04-12
Description: There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://prosupport.logi.com/hc/en-us/articles/[PII_REDACTED]14-Download-Logitech-Sync; https://prosupport.logi.com/hc/en-us/articles/[PII_REDACTED]14-Download-Logitech-Sync
CVE: CVE-2022-27376
Published: 2022-04-12
Description: MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-26354; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27377
Published: 2022-04-12
Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-26281; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27378
Published: 2022-04-12
Description: An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26423; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27379
Published: 2022-04-12
Description: An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26353; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27380
Published: 2022-04-12
Description: An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26280; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27381
Published: 2022-04-12
Description: An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26061; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27382
Published: 2022-04-12
Description: MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://jira.mariadb.org/browse/MDEV-26402; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-26402
CVE: CVE-2022-27383
Published: 2022-04-12
Description: MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-26323; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27384
Published: 2022-04-12
Description: An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26047; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27385
Published: 2022-04-12
Description: An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26415; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-26415
CVE: CVE-2022-27386
Published: 2022-04-12
Description: MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.mariadb.org/browse/MDEV-26406; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27387
Published: 2022-04-12
Description: MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://jira.mariadb.org/browse/MDEV-26422; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27416
Published: 2022-04-12
Description: Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/appneta/tcpreplay/issues/702; https://security.gentoo.org/glsa/202210-08; https://github.com/appneta/tcpreplay/issues/702
CVE: CVE-2022-27418
Published: 2022-04-12
Description: Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/appneta/tcpreplay/issues/703; https://security.gentoo.org/glsa/202210-08; https://github.com/appneta/tcpreplay/issues/703
CVE: CVE-2022-27419
Published: 2022-04-12
Description: rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/merbanan/rtl_433/issues/2012; https://github.com/merbanan/rtl_433/issues/2012
CVE: CVE-2022-29036
Published: 2022-04-12
Description: Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29037
Published: 2022-04-12
Description: Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29038
Published: 2022-04-12
Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29039
Published: 2022-04-12
Description: Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29040
Published: 2022-04-12
Description: Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29041
Published: 2022-04-12
Description: Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29042
Published: 2022-04-12
Description: Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29043
Published: 2022-04-12
Description: Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29044
Published: 2022-04-12
Description: Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE: CVE-2022-29045
Published: 2022-04-12
Description: Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617; https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617