rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-34765 
A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is written to the file path. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Schneider Electric
product: OPC UA Modicon Communication Module
vendor: Schneider Electric
product: X80 advanced RTU Communication Module
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2022-07-13T21:11:13.251Z
CVE-2022-34767 ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan Authorization Bypass
Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and can be accessed publicly.
Problem types: description: Authorization Bypass
Affected products: vendor: ALLNET Gmbh
product: ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: MetaData
Published: 2022-07-21T15:37:00.000Z
CVE-2022-34768 Synel - eHarmony Stored XSS
insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Synel
product: eHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Moriel Harush - Sophtix Security LTD
Published: 2022-08-05T15:24:50.903Z
CVE-2022-34769 Michlol - rashim web interface Insecure direct object references (IDOR)
Michlol - rashim web interface Insecure direct object references (IDOR).
First of all, the attacker needs to login.
After he performs log into the system there are some functionalities that the specific user is not allowed to perform.
However all the attacker needs to do in order to achieve his goals is to change the value of the ptMsl parameter and then
the attacker can access sensitive data that he not supposed to access because its belong to another user.
Problem types: description: interface Insecure direct object references
Affected products: vendor: Michlol
product: Michlol - rashim web
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-08-05T15:25:06.930Z
CVE-2022-34770 Tabit - sensitive information disclosure
Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoDB ID which is not so simple to enumerate. However, they each receive a ‘tiny URL’ in Tabit’s domain, in the form of https://tbit.be/{suffix} with suffix being a 5 characters long string containing numbers, lower- and upper-case letters. It is not so simple to enumerate them all, but really easy to find some that work and lead to a personal endpoint. This is both an example of OWASP: API4 - rate limiting and OWASP: API1 - Broken object level authorization. Furthermore, the redirect URL disclosed the MongoDB IDs discussed above, and we could use them to query other endpoints disclosing more personal information. For example: The URL https://tabitisrael.co.il/online-reservations/health-statement?orgId={org_id}&healthStatementId={health_statement_id} is used to invite friends to fill a health statement before attending the restaurant. We can use the health_statement_id to access the https://tgm-api.tabit.cloud/health-statement/{health_statement_id} API which disclose medical information as well as id number.
Problem types: description: sensitive information disclosure
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:41:16.634Z
CVE-2022-34771 Tabit - arbitrary SMS send on Tabits behalf
Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP.
Problem types: description: arbitrary SMS send on Tabits behalf
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:40:51.365Z
CVE-2022-34772 Tabit - password enumeration
Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting.
Problem types: description: password enumeration
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:42:58.504Z
CVE-2022-34773 Tabit - HTTP Method manipulation
Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection.
Problem types: description: HTTP Method manipulation
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:41:38.251Z
CVE-2022-34774 Tabit - Arbitrary account modification
Tabit - Arbitrary account modification. One of the endpoints mapped by the tiny URL, was a page where an adversary can modify personal details, such as email addresses and phone numbers of a specific user in a restaurant's loyalty program. Possibly allowing account takeover (the mail can be used to reset password).
Problem types: description: Arbitrary account modification
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:41:59.673Z
CVE-2022-34775 Tabit - Excessive data exposure
Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/{reservationId}?organization={orgId} API which returns a lot of data regarding the reservation (OWASP: API3): Name, mail, phone number, the number of visits of the user to this specific restaurant, the money he spent there, the money he spent on alcohol, whether he left a deposit etc. This information can easily be used for a phishing attack.
Problem types: description: Excessive data exposure
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:42:21.732Z
CVE-2022-34776 Tabit - giftcard stealth
Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not so simple to enumerate. However, they each receive a 'tiny URL' in tabits domain, in the form of https://tbit.be/{suffix} with suffix being a 5 character long string containing numbers, lower and upper case letters. It is not so simple to enumerate them all, but really easy to find some that work and lead to a personal endpoint. Furthermore, the redirect URL disclosed the MongoDB IDs discussed above, and we could use them to query other endpoints disclosing more personal information.
Problem types: description: giftcard stealth
Affected products: vendor: Tabit
product: Tabit
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Guy Ben Simhon - Noname Security
Published: 2022-08-22T14:42:38.815Z
CVE-2022-34777 
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins GitLab Plugin
Published: 2022-06-30T17:45:54.000Z
CVE-2022-34778 
Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results.
Affected products: vendor: Jenkins project
product: Jenkins TestNG Results Plugin
Published: 2022-06-30T17:45:59.000Z
CVE-2022-34779 
A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins XebiaLabs XL Release Plugin
Published: 2022-06-30T17:46:05.000Z
CVE-2022-34780 
A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins XebiaLabs XL Release Plugin
Published: 2022-06-30T17:46:10.000Z
CVE-2022-34781 
Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins XebiaLabs XL Release Plugin
Published: 2022-06-30T17:46:18.000Z
CVE-2022-34782 
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
Affected products: vendor: Jenkins project
product: Jenkins requests-plugin Plugin
Published: 2022-06-30T17:46:21.000Z
CVE-2022-34783 
Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Plot Plugin
Published: 2022-06-30T17:46:27.000Z
CVE-2022-34784 
Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
Affected products: vendor: Jenkins project
product: Jenkins build-metrics Plugin
Published: 2022-06-30T17:46:33.000Z
CVE-2022-34785 
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
Affected products: vendor: Jenkins project
product: Jenkins build-metrics Plugin
Published: 2022-06-30T17:46:40.000Z
CVE-2022-34786 
Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
Affected products: vendor: Jenkins project
product: Jenkins Rich Text Publisher Plugin
Published: 2022-06-30T17:46:46.000Z
CVE-2022-34787 
Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
Affected products: vendor: Jenkins project
product: Jenkins Project Inheritance Plugin
Published: 2022-06-30T17:46:51.000Z
CVE-2022-34788 
Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Matrix Reloaded Plugin
Published: 2022-06-30T17:46:56.000Z
CVE-2022-34789 
A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds.
Affected products: vendor: Jenkins project
product: Jenkins Matrix Reloaded Plugin
Published: 2022-06-30T17:47:04.000Z
CVE-2022-34790 
Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins eXtreme Feedback Panel Plugin
Published: 2022-06-30T17:47:07.000Z
CVE-2022-34791 
Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Validating Email Parameter Plugin
Published: 2022-06-30T17:47:15.000Z
CVE-2022-34792 
A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
Affected products: vendor: Jenkins project
product: Jenkins Recipe Plugin
Published: 2022-06-30T17:47:20.000Z
CVE-2022-34793 
Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Recipe Plugin
Published: 2022-06-30T17:47:24.000Z
CVE-2022-34794 
Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
Affected products: vendor: Jenkins project
product: Jenkins Recipe Plugin
Published: 2022-06-30T17:47:29.000Z
CVE-2022-34795 
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Deployment Dashboard Plugin
Published: 2022-06-30T17:47:34.000Z
CVE-2022-34796 
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Deployment Dashboard Plugin
Published: 2022-06-30T17:47:42.000Z
CVE-2022-34797 
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins Deployment Dashboard Plugin
Published: 2022-06-30T17:47:47.000Z
CVE-2022-34798 
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins Deployment Dashboard Plugin
Published: 2022-06-30T17:47:52.000Z
CVE-2022-34799 
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Deployment Dashboard Plugin
Published: 2022-06-30T17:47:58.000Z
CVE-2022-34800 
Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Build Notifications Plugin
Published: 2022-06-30T17:48:04.000Z
CVE-2022-34801 
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Affected products: vendor: Jenkins project
product: Jenkins Build Notifications Plugin
Published: 2022-06-30T17:48:09.000Z
CVE-2022-34802 
Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins RocketChat Notifier Plugin
Published: 2022-06-30T17:48:14.000Z
CVE-2022-34803 
Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins OpsGenie Plugin
Published: 2022-06-30T17:48:21.000Z
CVE-2022-34804 
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
Affected products: vendor: Jenkins project
product: Jenkins OpsGenie Plugin
Published: 2022-06-30T17:48:29.000Z
CVE-2022-34805 
Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Skype notifier Plugin
Published: 2022-06-30T17:48:35.000Z
CVE-2022-34806 
Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Jigomerge Plugin
Published: 2022-06-30T17:48:39.000Z
CVE-2022-34807 
Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Elasticsearch Query Plugin
Published: 2022-06-30T17:48:43.000Z
CVE-2022-34808 
Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Cisco Spark Plugin
Published: 2022-06-30T17:48:49.000Z
CVE-2022-34809 
Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins RQM Plugin
Published: 2022-06-30T17:48:53.000Z
CVE-2022-34810 
A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins RQM Plugin
Published: 2022-06-30T17:48:59.000Z
CVE-2022-34811 
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Configuration Viewer page.
Affected products: vendor: Jenkins project
product: Jenkins XPath Configuration Viewer Plugin
Published: 2022-06-30T17:49:05.000Z
CVE-2022-34812 
A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath expressions.
Affected products: vendor: Jenkins project
product: Jenkins XPath Configuration Viewer Plugin
Published: 2022-06-30T17:49:10.000Z
CVE-2022-34813 
A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
Affected products: vendor: Jenkins project
product: Jenkins XPath Configuration Viewer Plugin
Published: 2022-06-30T17:49:15.000Z