Description
Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).
Remediation
References
Related Vulnerabilities
WordPress Plugin YITH WooCommerce Zoom Magnifier Cross-Site Scripting (1.1.8)
WordPress Plugin File Manager Information Disclosure (6.4)
WordPress Plugin SMS Alert Order Notifications-WooCommerce Cross-Site Scripting (3.4.6)
WordPress Plugin LearnPress-WordPress LMS Multiple Cross-Site Scripting Vulnerabilities (4.1.3)