CVE-2022-20619

jenkins-2-plugins/cloudbees-bitbucket-branch-source: no POST request is required for an http endpoint which could allow capturing credentials stored in Jenkins

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jenkins

Products

Bitbucket Branch Source

CVE-2022-20613

jenkins-2-plugins/mailer: form validation method does not require POST requests which could lead to CSRF

A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Oracle

Products

Mailer Communications Cloud Native Core Automated Test Suite

CVE-2022-20612

jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift

CVE-2022-1967

WP Championship < 9.3 - Multiple CSRF

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wp-championship Project

Products

Wp-championship

CVE-2022-1960

MyCSS <= 1.1 - Arbitrary Settings Update via CSRF

The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycss Project

Products

Mycss

CVE-2022-1957

Comment License < 1.4.0 - Arbitrary Settings Update via CSRF

The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Comment License Project

Products

Comment License

CVE-2022-1956

Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update

The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Shortcut Macros Project

Products

Shortcut Macros

CVE-2022-1914

Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF

The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Clean-contact Project

Products

Clean-contact

CVE-2022-1913

Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Add Post Url Project

Products

Add Post Url

CVE-2022-1895

underConstruction < 1.20 - Construction Mode Deactivation via CSRF

The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Underconstruction Project

Products

Underconstruction

CVE-2022-1885

Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRF

The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cimy Header Image Rotator Project

Products

Cimy Header Image Rotator

CVE-2022-1847

Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rotating Posts Project

Products

Rotating Posts

CVE-2022-1846

Tiny Contact Form <= 0.7 - Arbitrary Settings Update via CSRF

The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tiny Contact Form Project

Products

Tiny Contact Form

CVE-2022-1845

WP Post Styling < 1.3.1 - Multiple CSRF

The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Post Styling Project

Products

Wp Post Styling

CVE-2022-1844

WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wp-sentry Project

Products

Wp-sentry

CVE-2022-1843

MailPress <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF

The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mailpress Project

Products

Mailpress

CVE-2022-1842

OpenBook Book Data <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF

The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openbook Book Data Project

Products

Openbook Book Data

CVE-2022-1832

CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF

The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Capa Protect Project

Products

Capa Protect

CVE-2022-1831

WPlite <= 1.3.1 - Arbitrary Settings Update via CSRF

The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wplite Project

Products

Wplite

CVE-2022-1830

Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF

The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Amazon Einzeltitellinks Project

Products

Amazon Einzeltitellinks