Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,966 results · page 22 of 40
Jul 29, 2022The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact.CVE-2022-35632 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.8
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflCVE-2022-36922 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Lucene-Search Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 20, 2022An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisplayInterface serviceCVE-2020-21406 · Other software · V88 Smart TV BOX Project · reported by MITREHigh 7.5
An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisplayInterface service.
- Product
- V88 Smart TV BOX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory.CVE-2022-30625 · Other software · Chcnav · reported by cna@cyber.gov.ilMedium 5.7
Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences vary depending on which files are listed and accessible.
- Product
- Chcnav - P5E GNSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Contact Slider
- Fixed in
- 2.4.7
- What to do
- Update WP Contact Slider to 2.4.7 or newer.
Jul 4, 2022Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain CVE-2022-29892 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).
- Product
- Cybozu Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rCVE-2022-1740 · Other software · Dominion Voting Systems · reported by ics-cert@hq.dhs.govMedium 4.6
The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device.
- Product
- ImageCast X application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resuCVE-2022-34198 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Stash Branch Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulCVE-2022-34197 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Sauce OnDemand Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting CVE-2022-34196 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins REST List Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying paramCVE-2022-34195 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Repository Connector Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displayingCVE-2022-34194 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Readonly Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored crCVE-2022-34193 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Package Version Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters,CVE-2022-34191 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins NS-ND Integration Performance Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting iCVE-2022-34189 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Image Tag Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resultCVE-2022-34188 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Hidden Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying pCVE-2022-34187 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Filesystem List Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displayCVE-2022-34186 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Dynamic Extended Choice Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a storeCVE-2022-34185 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Date Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displayinCVE-2022-34184 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins CRX Content Package Deployer Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resultCVE-2022-34183 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Agent Server Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in CVE-2022-34173 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
- Product
- underConstruction
- Fixed in
- 1.21
- What to do
- Update underConstruction to 1.21 or newer.
Jun 13, 2022Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services.CVE-2022-31760 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jun 7, 2022Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message informaCVE-2022-30716 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 3, 2022In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core).CVE-2022-32269 · Other software · Realnetworks · reported by MITRECritical 9.8
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution.
- Product
- Realplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 18, 2022A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.CVE-2022-30596 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validatioCVE-2022-28190 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validation can cause denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer dereferenCVE-2022-28189 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer dereference may lead to a system crash.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives inpCVE-2022-28188 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a CVE-2022-28187 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives inpCVE-2022-28186 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.1
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service or data tampering.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, CVE-2022-28185 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comsecurity.gentoo.org
May 17, 2022NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivilegeCVE-2022-28184 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular user can access administrator- privileged registers, which may lead to denial of service, information disclosure, and data tampering.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comsecurity.gentoo.org
May 17, 2022NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-boundsCVE-2022-28183 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.7
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-bounds read, which may lead to denial of service and information disclosure.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comsecurity.gentoo.org
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the networkCVE-2022-28182 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution to cause denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause aCVE-2022-28181 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.5
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comsecurity.gentoo.org
May 17, 2022Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a storeCVE-2022-30968 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins vboxwrapper Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parametCVE-2022-30967 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Selection tasks Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resuCVE-2022-30966 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Random String Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, rCVE-2022-30965 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Promoted Builds (Simple) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resultinCVE-2022-30964 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Multiselect parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored crCVE-2022-30963 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins JDK Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayinCVE-2022-30962 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Global Variable String Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying CVE-2022-30961 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Autocomplete Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultingCVE-2022-30960 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Application Detector Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022WP Subtitle: Adds a subtitle field and provides a shortcode to display it via [wp_subtitle]CVE-2022-1393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.
- Product
- WP Subtitle
- Fixed in
- 3.4.1
- What to do
- Update WP Subtitle to 3.4.1 or newer.
May 13, 2022College Management System v1.0 is vulnerable to SQL Injection via /College_Management_System/admin/display-teacher.php?teacher_id=.CVE-2022-30404 · Other software · College Management System Project · reported by MITREHigh 7.2
College Management System v1.0 is vulnerable to SQL Injection via /College_Management_System/admin/display-teacher.php?teacher_id=.
- Product
- College Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022A flaw was found in the QXL display device emulation in QEMU.CVE-2021-4207 · Other software · Qemu · reported by Red HatHigh 8.2
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.