https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 18:56:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-14464 EUVD-2026-14464 https://cve.radiocsirt.org/vuln/euvd-2026-14464 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25207 <p>A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.</p> <p>A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-25207 https://cve.radiocsirt.org/vuln/ghsa-x92v-xv3x-9v29 <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:sinatra-chef-builder</p> <p>Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.</p> <p>This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML.</p> <p>As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.</p> <p>Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:sinatra-chef-builder</p> <p>Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.</p> <p>This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML.</p> <p>As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.</p> <p>Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-x92v-xv3x-9v29 https://cve.radiocsirt.org/vuln/gsd-2022-25207 gsd-2022-25207 https://cve.radiocsirt.org/vuln/gsd-2022-25207