Dyingman1

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

**Name of the Vulnerable Software and Affected Versions** Jenkins Bitbucket OAuth Plugin versions prior to 0.18 **Description** The plugin fails to restrict the redirect URL after the login process, which enables attackers to conduct phishing attacks via open redirection. **Recommendations** Update to a version later than 0.17.

**Name of the Vulnerable Software and Affected Versions** Jenkins GitHub Integration Plugin versions prior to 0.7.4 **Description** A cross-site request forgery (CSRF) flaw allows attackers to trigger a build for a pull request. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated. **Recommendations** Update to a version later than 0.7.3.

**Name of the Vulnerable Software and Affected Versions** Jenkins buildgraph-view Plugin versions prior to 1.9 **Description** The buildgraph-view Plugin fails to escape the build URL, leading to a stored cross-site scripting (XSS) issue. This can be exploited by attackers who have permissions to configure jobs or views. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update to a version later than 1.8.

**Name of the Vulnerable Software and Affected Versions** Jenkins Multijob Plugin versions prior to 662.vd2e0001f6b b d **Description** A cross-site request forgery (CSRF) flaw allows attackers to resume failed Multijob builds. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated. **Recommendations** Update the Jenkins Multijob Plugin to a version later than 662.vd2e0001f6b b d.

**Name of the Vulnerable Software and Affected Versions** Jenkins Job Import Plugin versions prior to 143.v044a 2e819b 27 **Description** A missing permission check in an HTTP endpoint allows users with Overall/Read permissions to enumerate the IDs of credentials stored within Jenkins. **Recommendations** Update the plugin to a version later than 143.v044a 2e819b 27.

**Name of the Vulnerable Software and Affected Versions** Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions prior to 666.v6060de32f87d **Description** The plugin does not restrict the redirect URL after login, which allows attackers to perform phishing attacks. **Recommendations** Update the plugin to a version later than 666.v6060de32f87d.