rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-1003050 
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-04-10T20:12:30.000Z
CVE-2019-1003051 
Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins IRC Plugin
Published: 2019-04-04T15:38:47.000Z
CVE-2019-1003052 
Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins AWS Elastic Beanstalk Publisher Plugin
Published: 2019-04-04T15:38:47.000Z
CVE-2019-1003053 
Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins HockeyApp Plugin
Published: 2019-04-04T15:38:47.000Z
CVE-2019-1003054 
Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Jira Issue Updater Plugin
Published: 2019-04-04T15:38:47.000Z
CVE-2019-1003055 
Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins FTP publisher Plugin
Published: 2019-04-04T15:38:47.000Z
CVE-2019-1003056 
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins WebSphere Deployer Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003057 
Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Bitbucket Approve Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003058 
A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins FTP publisher Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003059 
A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins FTP publisher Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003060 
Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Official OWASP ZAP Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003061 
Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins jenkins-cloudformation-plugin Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003062 
Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins AWS CloudWatch Logs Publisher Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003063 
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Amazon SNS Build Notifier Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003064 
Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins aws-device-farm Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003065 
Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins CloudShare Docker-Machine Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003066 
Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Bugzilla Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003067 
Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Trac Publisher Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003068 
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins VMware vRealize Automation Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003069 
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Aqua Security Scanner Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003070 
Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins veracode-scanner Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003071 
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins OctopusDeploy Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003072 
Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins WildFly Deployer Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003073 
Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins VS Team Services Continuous Deployment Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003074 
Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Hyper.sh Commons Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003075 
Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Audit to Database Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003076 
A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Audit to Database Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003077 
A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Audit to Database Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003078 
A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins VMware Lab Manager Slaves Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003079 
A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins VMware Lab Manager Slaves Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003080 
A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins OpenShift Deployer Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003081 
A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins OpenShift Deployer Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003082 
A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Gearman Plugin
Published: 2019-04-04T15:38:48.000Z
CVE-2019-1003083 
A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Gearman Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003084 
A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Zephyr Enterprise Test Management Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003085 
A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Zephyr Enterprise Test Management Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003086 
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Chef Sinatra Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003087 
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Chef Sinatra Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003088 
Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Fabric Beta Publisher Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003089 
Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Upload to pgyer Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003090 
A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins SOASTA CloudTest Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003091 
A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins SOASTA CloudTest Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003092 
A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Nomad Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003093 
A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Nomad Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003094 
Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Open STF Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003095 
Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Perfecto Mobile Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003096 
Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins TestFairy Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003097 
Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected products: vendor: Jenkins project
product: Jenkins Crowd Integration Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003098 
A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins openid Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1003099 
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins openid Plugin
Published: 2019-04-04T15:38:49.000Z
CVE-2019-1010003 
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Leanote
product: Leanote
Published: 2019-07-11T12:32:21.000Z
CVE-2019-1010004 
SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.
Problem types: description: Out-of-bounds Read
Affected products: vendor: Sourceforge
product: SoX - Sound eXchange
Published: 2019-07-15T01:44:34.000Z
CVE-2019-1010005 
HexoEditor v1.1.8-beta is affected by: XSS to code execution.
Problem types: description: XSS to code execution
Affected products: vendor: HexoEditor
product: HexoEditor
Published: 2019-07-15T01:45:28.000Z
CVE-2019-1010006 
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.
Problem types: description: Buffer Overflow
Affected products: vendor: Evince Team
product: Evince
Published: 2019-07-15T01:50:17.000Z
CVE-2019-1010008 
OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: OpenEnergyMonitor Project
product: Emoncms
Published: 2019-07-15T01:54:52.000Z
CVE-2019-1010009 
DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The attack vector is: Any Accessible Server.
Problem types: description: Insecure Permissions
Affected products: vendor: DGLogik Inc
product: DGLux Server
Published: 2019-07-15T02:00:46.000Z
CVE-2019-1010016 
Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: Dolibarr ERP & CRM
product: Dolibarr
Published: 2019-07-15T02:23:30.000Z
CVE-2019-1010017 
libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
Problem types: description: XML Injection
Affected products: vendor: libnmap
product: libnmap
Published: 2019-07-15T02:25:52.000Z
CVE-2019-1010018 
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
Problem types: cwe_id: CWE-80
description: Cross Site Scripting (XSS) - CWE-80
Affected products: vendor: Zammad GmbH
product: Zammad
Published: 2019-07-16T12:35:14.000Z
CVE-2019-1010022 
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
Problem types: description: Mitigation bypass
Affected products: vendor: GNU C Library
product: glibc
Published: 2019-07-15T03:00:51.000Z
CVE-2019-1010023 
GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
Problem types: description: Re-mapping current loaded libray with malicious ELF file
Affected products: vendor: GNU Libc
product: glibc
Published: 2019-07-15T03:09:37.000Z
CVE-2019-1010024 
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
Problem types: description: Mitigation bypass
Affected products: vendor: GNU Libc
product: glibc
Published: 2019-07-15T03:06:26.000Z
CVE-2019-1010025 
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.
Problem types: description: Mitigation bypass
Affected products: vendor: GNU Libc
product: glibc
Published: 2019-07-15T03:11:46.000Z
CVE-2019-1010028 
phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />.
Problem types: description: Cross Site Scripting (XSS)
Affected products: vendor: PHP Scripts Mall Pvt. Ltd.
product: School College Portal with ERP Script
Published: 2019-07-15T03:24:19.000Z
CVE-2019-1010034 
Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.
Problem types: description: SQL Injection
Affected products: vendor: Deepwoods Software
product: WebLibrarian
Published: 2019-07-15T12:39:12.000Z