rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-41898  Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: home-assistant
product: core
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-10-19T22:08:40.783Z
CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core 
Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-162`.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: home-assistant
product: core
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-10-19T22:18:31.224Z
CVE-2023-41900 Jetty's OpenId Revoked authentication allows one request
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
Problem types: cwe_id: CWE-1390
description: CWE-1390: Weak Authentication
Affected products: vendor: eclipse
product: jetty.project
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2023-09-15T20:17:42.201Z
CVE-2023-41902 
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-41904 
Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-26T00:00:00.000Z
CVE-2023-41905 
NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-41908 
Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-41909 
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-41910 
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2023-41911 
Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:L/A:H/C:N/I:N/PR:N/S:U/UI:R
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 4.7
baseSeverity: MEDIUM
Published: 2023-09-28T00:00:00.000Z
CVE-2023-41913 
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-41914 
SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-03T00:00:00.000Z
CVE-2023-41915 
OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-09T00:00:00.000Z
CVE-2023-41916 Apache Linkis DataSource: DatasourceManager module has a  JDBC parameter judgment logic vulnerability that allows for arbitrary file reading

In Apache Linkis =1.4.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. 
We recommend users upgrade the version of Linkis to version 1.5.0.


Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Apache Software Foundation
product: Apache Linkis DataSource
default_status: unaffected
Credits: lang: en
value: Pho3n1x 
lang: en
value:  L0ne1y
Published: 2024-07-15T07:53:57.843Z
CVE-2023-41917 Improper input validation in Kiloview P1/P2 devices allows for remote code execution
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2024-07-02T07:41:28.397Z
CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2024-07-02T07:42:08.260Z
CVE-2023-41919 Use of Hard-coded Credentials in Kiloview P1/P2 devices
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2024-07-02T07:42:16.318Z
CVE-2023-41920 Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2024-07-02T07:42:24.484Z
CVE-2023-41921 Download of Code Without Integrity Check in Kiloview P1/P2 devices
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2024-07-02T07:42:33.722Z
CVE-2023-41922 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2024-07-02T07:42:42.031Z
CVE-2023-41923 Weak Password Requirements in Kiloview P1/P2 devices
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2024-07-02T07:42:49.840Z
CVE-2023-41926 Insufficiently protected credentials in Kiloview P1/P2 devices
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2024-07-02T07:43:16.362Z
CVE-2023-41927 Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices
The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.
Problem types: cwe_id: CWE-327
description: CWE-327: Inadequate Encryption Strength
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2024-07-02T07:43:25.640Z
CVE-2023-41928 Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices
The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Kiloview
product: P1/P2
default_status: affected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2024-07-02T07:43:31.998Z
CVE-2023-41929 
A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows to exploit this vulnerability.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
Published: 2023-09-18T00:00:00.000Z
CVE-2023-41930 
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
Affected products: vendor: Jenkins Project
product: Jenkins Job Configuration History Plugin
default_status: unaffected
Published: 2023-09-06T12:08:52.399Z
CVE-2023-41931 
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected products: vendor: Jenkins Project
product: Jenkins Job Configuration History Plugin
default_status: unaffected
Published: 2023-09-06T12:08:53.040Z
CVE-2023-41932 
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.
Affected products: vendor: Jenkins Project
product: Jenkins Job Configuration History Plugin
default_status: unaffected
Published: 2023-09-06T12:08:53.687Z
CVE-2023-41933 
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Job Configuration History Plugin
default_status: unaffected
Published: 2023-09-06T12:08:54.329Z
CVE-2023-41934 
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
Affected products: vendor: Jenkins Project
product: Jenkins Pipeline Maven Integration Plugin
default_status: unaffected
Published: 2023-09-06T12:08:55.028Z
CVE-2023-41935 
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
Affected products: vendor: Jenkins Project
product: Jenkins Azure AD Plugin
default_status: affected
Published: 2023-09-06T12:08:55.693Z
CVE-2023-41936 
Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token.
Affected products: vendor: Jenkins Project
product: Jenkins Google Login Plugin
default_status: unaffected
Published: 2023-09-06T12:08:56.365Z
CVE-2023-41937 
Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload.
Affected products: vendor: Jenkins Project
product: Jenkins Bitbucket Push and Pull Request Plugin
default_status: unaffected
Published: 2023-09-06T12:08:57.044Z
CVE-2023-41938 
A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules.
Affected products: vendor: Jenkins Project
product: Jenkins Ivy Plugin
default_status: unknown
Published: 2023-09-06T12:08:57.719Z
CVE-2023-41939 
Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
Affected products: vendor: Jenkins Project
product: Jenkins SSH2 Easy Plugin
default_status: unaffected
Published: 2023-09-06T12:08:58.383Z
CVE-2023-41940 
Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control TAP file contents.
Affected products: vendor: Jenkins Project
product: Jenkins TAP Plugin
default_status: unknown
Published: 2023-09-06T12:08:59.019Z
CVE-2023-41941 
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins AWS CodeCommit Trigger Plugin
default_status: unknown
Published: 2023-09-06T12:08:59.655Z
CVE-2023-41942 
A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue.
Affected products: vendor: Jenkins Project
product: Jenkins AWS CodeCommit Trigger Plugin
default_status: unknown
Published: 2023-09-06T12:09:00.293Z
CVE-2023-41943 
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.
Affected products: vendor: Jenkins Project
product: Jenkins AWS CodeCommit Trigger Plugin
default_status: unknown
Published: 2023-09-06T12:09:00.938Z
CVE-2023-41944 
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability.
Affected products: vendor: Jenkins Project
product: Jenkins AWS CodeCommit Trigger Plugin
default_status: unknown
Published: 2023-09-06T12:09:01.584Z
CVE-2023-41945 
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted.
Affected products: vendor: Jenkins Project
product: Jenkins Assembla Auth Plugin
default_status: unknown
Published: 2023-09-06T12:09:02.231Z
CVE-2023-41946 
A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.
Affected products: vendor: Jenkins Project
product: Jenkins Frugal Testing Plugin
default_status: unknown
Published: 2023-09-06T12:09:02.919Z
CVE-2023-41947 
A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.
Affected products: vendor: Jenkins Project
product: Jenkins Frugal Testing Plugin
default_status: unknown
Published: 2023-09-06T12:09:03.587Z