Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-41238 | 1 Jenkins | 1 Dotci | 2022-09-22 | N/A | 9.8 CRITICAL |
| A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits. | |||||
| CVE-2022-41241 | 1 Jenkins | 1 Rqm | 2022-09-22 | N/A | 9.1 CRITICAL |
| Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | |||||
| CVE-2022-41240 | 1 Jenkins | 1 Walti | 2022-09-22 | N/A | 5.4 MEDIUM |
| Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti. | |||||
| CVE-2006-7142 | 1 Utimaco Safeware | 1 Safeguard Easy | 2022-09-22 | 4.1 MEDIUM | N/A |
| The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive. | |||||
| CVE-2022-41242 | 1 Jenkins | 1 Extreme-feedback | 2022-09-22 | N/A | 5.4 MEDIUM |
| A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job names attached to lamps, discover MAC and IP addresses of existing lamps, and rename lamps. | |||||
| CVE-2022-41243 | 1 Jenkins | 1 Smalltest | 2022-09-22 | N/A | 8.1 HIGH |
| Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections. | |||||
| CVE-2022-41244 | 1 Jenkins | 1 View26 Test-reporting | 2022-09-22 | N/A | 8.1 HIGH |
| Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections. | |||||
| CVE-2022-41245 | 1 Jenkins | 1 Worksoft Execution Manager | 2022-09-22 | N/A | 8.8 HIGH |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2022-41246 | 1 Jenkins | 1 Worksoft Execution Manager | 2022-09-22 | N/A | 6.5 MEDIUM |
| A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2022-41233 | 1 Jenkins | 1 Rundeck | 2022-09-22 | N/A | 4.3 MEDIUM |
| Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled. | |||||
| CVE-2022-40604 | 1 Apache | 1 Airflow | 2022-09-22 | N/A | 7.5 HIGH |
| In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. | |||||
| CVE-2022-40754 | 1 Apache | 1 Airflow | 2022-09-22 | N/A | 6.1 MEDIUM |
| In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. | |||||
| CVE-2022-2888 | 1 Octoprint | 1 Octoprint | 2022-09-22 | N/A | 4.4 MEDIUM |
| If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. | |||||
| CVE-2022-3068 | 1 Octoprint | 1 Octoprint | 2022-09-22 | N/A | 8.8 HIGH |
| Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. | |||||
| CVE-2022-38928 | 1 Xpdfreader | 1 Xpdf | 2022-09-22 | N/A | 7.8 HIGH |
| XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. | |||||
| CVE-2022-41224 | 1 Jenkins | 1 Jenkins | 2022-09-22 | N/A | 5.4 MEDIUM |
| Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component. | |||||
| CVE-2022-41225 | 1 Jenkins | 1 Anchore Container Image Scanner | 2022-09-22 | N/A | 5.4 MEDIUM |
| Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine. | |||||
| CVE-2022-41226 | 1 Jenkins | 1 Compuware Common Configuration | 2022-09-22 | N/A | 9.8 CRITICAL |
| Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | |||||
| CVE-2021-31002 | 1 Apple | 1 Macos | 2022-09-22 | 6.8 MEDIUM | 7.8 HIGH |
| An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey 12.0.1, macOS Big Sur 11.6.2. A malicious application may be able to execute arbitrary code with system privileges. | |||||
| CVE-2022-41228 | 1 Jenkins | 1 Ns-nd Integration Performance Publisher | 2022-09-22 | N/A | 8.8 HIGH |
| A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials. | |||||