rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-30492 WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 2.0.0.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Vark
product: Minimum Purchase for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2023-10-26T11:58:32.977Z
CVE-2023-30493 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Themefic
product: Ultimate Addons for Contact Form 7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-09-27T10:54:37.117Z
CVE-2023-30494 WordPress ImageRecycle pdf & image compression Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ImageRecycle ImageRecycle pdf & image compression plugin <= 3.1.10 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ImageRecycle
product: ImageRecycle pdf & image compression
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: OZ1NG TOOR-LISA (Patchstack Alliance)
Published: 2023-09-04T10:28:30.660Z
CVE-2023-30495 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Themefic
product: Ultimate Addons for Contact Form 7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Ivy - TOOR, LISA (Patchstack Alliance)
Published: 2023-12-20T17:09:25.312Z
CVE-2023-30496 WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MagePeople Team
product: WpBusTicketly
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Ivy - TOOR, LISA (Patchstack Alliance)
Published: 2023-11-22T19:46:36.727Z
CVE-2023-30497 WordPress LINE Notify Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Simon Chuang WP LINE Notify plugin <= 1.4.4 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Simon Chuang
product: WP LINE Notify
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Ivy - TOOR, LISA (Patchstack Alliance)
Published: 2023-09-06T08:01:35.581Z
CVE-2023-30498 WordPress Vimeotheque Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CodeFlavors
product: Vimeotheque: Vimeo WordPress Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Ivy - TOOR, LISA (Patchstack Alliance)
Published: 2023-08-15T12:45:55.098Z
CVE-2023-30499 WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: FolioVision
product: FV Flowplayer Video Player
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-08-18T14:41:03.606Z
CVE-2023-30500 WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WPForms
product: WPForms Lite
default_status: unaffected
vendor: WPForms
product: WPForms Pro
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-06-22T11:45:21.403Z
CVE-2023-30501 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Erik De Jong (bugcrowd.com/erikdejong)
Published: 2023-05-16T18:49:59.884Z
CVE-2023-30502 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Erik De Jong (bugcrowd.com/erikdejong)
Published: 2023-05-16T18:51:27.762Z
CVE-2023-30503 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:51:40.985Z
CVE-2023-30504 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:51:43.801Z
CVE-2023-30505 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:51:46.597Z
CVE-2023-30506 Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:51:50.159Z
CVE-2023-30507 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value:   Erik De Jong (bugcrowd.com/erikdejong)
Published: 2023-05-16T18:54:48.679Z
CVE-2023-30508 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:55:01.993Z
CVE-2023-30509 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface
Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:55:05.306Z
CVE-2023-30510 Authenticated Server-side Request Forgery in Aruba EdgeConnect Enterprise Web Management Interface
A vulnerability exists in the Aruba EdgeConnect Enterprise web management interface that allows remote authenticated users to issue arbitrary URL requests from the Aruba EdgeConnect Enterprise instance. The impact of this vulnerability is limited to a subset of URLs which can result in the possible disclosure of data due to the network position of the Aruba EdgeConnect Enterprise instance.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba EdgeConnect Enterprise Software
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value:   Daniel Jensen (@dozernz)
Published: 2023-05-16T18:56:20.679Z
CVE-2023-30512 
CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-30513 
Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Affected products: vendor: Jenkins Project
product: Jenkins Kubernetes Plugin
default_status: affected
Published: 2023-04-12T17:05:05.743Z
CVE-2023-30514 
Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Affected products: vendor: Jenkins Project
product: Jenkins Azure Key Vault Plugin
default_status: unaffected
Published: 2023-04-12T17:05:06.453Z
CVE-2023-30515 
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
Affected products: vendor: Jenkins Project
product: Jenkins Thycotic DevOps Secrets Vault Plugin
default_status: unknown
Published: 2023-04-12T17:05:07.172Z
CVE-2023-30516 
Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.
Affected products: vendor: Jenkins Project
product: Jenkins Image Tag Parameter Plugin
default_status: unknown
Published: 2023-04-12T17:05:07.880Z
CVE-2023-30517 
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.
Affected products: vendor: Jenkins Project
product: Jenkins NeuVector Vulnerability Scanner Plugin
default_status: unknown
Published: 2023-04-12T17:05:08.593Z
CVE-2023-30518 
A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Thycotic Secret Server Plugin
default_status: unknown
Published: 2023-04-12T17:05:09.301Z
CVE-2023-30519 
A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Affected products: vendor: Jenkins Project
product: Jenkins Quay.io trigger Plugin
default_status: unknown
Published: 2023-04-12T17:05:10.014Z
CVE-2023-30520 
Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.
Affected products: vendor: Jenkins Project
product: Jenkins Quay.io trigger Plugin
default_status: unknown
Published: 2023-04-12T17:05:10.727Z
CVE-2023-30521 
A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Affected products: vendor: Jenkins Project
product: Jenkins Assembla merge request builder Plugin
default_status: unknown
Published: 2023-04-12T17:05:11.466Z
CVE-2023-30522 
A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter.
Affected products: vendor: Jenkins Project
product: Jenkins Fogbugz Plugin
default_status: unknown
Published: 2023-04-12T17:05:12.169Z
CVE-2023-30523 
Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Report Portal Plugin
default_status: unknown
Published: 2023-04-12T17:05:12.873Z
CVE-2023-30524 
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins Report Portal Plugin
default_status: unknown
Published: 2023-04-12T17:05:13.591Z
CVE-2023-30525 
A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified bearer token authentication.
Affected products: vendor: Jenkins Project
product: Jenkins Report Portal Plugin
default_status: unknown
Published: 2023-04-12T17:05:14.297Z
CVE-2023-30526 
A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.
Affected products: vendor: Jenkins Project
product: Jenkins Report Portal Plugin
default_status: unknown
Published: 2023-04-12T17:05:14.987Z
CVE-2023-30527 
Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins WSO2 Oauth Plugin
default_status: unknown
Published: 2023-04-12T17:05:15.700Z
CVE-2023-30528 
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.
Affected products: vendor: Jenkins Project
product: Jenkins WSO2 Oauth Plugin
default_status: unknown
Published: 2023-04-12T17:05:16.410Z
CVE-2023-30529 
Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.
Affected products: vendor: Jenkins Project
product: Jenkins Lucene-Search Plugin
default_status: unknown
Published: 2023-04-12T17:05:17.194Z