CVE Vulnerability Catalog

The Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

The Jenkins Eggplant Runner Plugin sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, disabling a protection mechanism of the Java runtime. This may allow attackers to bypass HTTP tunneling authentication restrictions.

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier contains a cross-site request forgery (CSRF) vulnerability. It allows attackers to execute sandboxed Groovy code.

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools. This allows attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

The Call Now Button plugin for WordPress up to version 1.5.4 has missing capability checks on multiple functions, allowing authenticated users with Subscriber-level access and above to access data such as billing portal links, chat session tokens, domain status, and modify billing information. Partially fixed in 1.5.4 and fully fixed in 1.5.5.

The Call Now Button plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to and including 1.5.3. This allows authenticated attackers with Subscriber-level access and above to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox. This issue affects Terra AC wallbox through 1.8.33.

This vulnerability allows an attacker to access parts of the application that are not protected by access control. The attacker can access the path '.../epsilonnet/License/About.aspx' and obtain information about the license and configuration of the product, including installed modules.

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link.

The Premmerce Product Search for WooCommerce plugin (versions up to and including 2.2.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation.

The MasterStudy LMS Pro plugin by StylemixThemes has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions before 4.7.16.

The Masterstudy Elementor Widgets plugin by StylemixThemes has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions up to and including 1.2.4.

The Masterstudy Elementor Widgets plugin by StylemixThemes up to version 1.2.4 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.

TieLabs Jannah - Extensions (jannah-extensions) up to version 1.1.4 has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation.

ThemeSphere SmartMag (smart-mag) up to version 10.3.1 has a Stored XSS vulnerability due to improper neutralization of input during web page generation.

TieLabs Sahifa (sahifa) before version 5.8.6 has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation.