io.jenkins.blueocean:blueocean (>=1.0.0-rc2, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-rc2, <=1.0.0) +8 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.7)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-rc2,...

io.jenkins.blueocean:blueocean (>=1.0.0-b15, <=1.0.0-b21), io.jenkins.blueocean:blueocean-github-pipeline (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.3)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b15,...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0.0-b22), io.jenkins.blueocean:blueocean-analytics-tools (>=1.0-alpha-5, <=1.0-alpha-7) +12 more potentially affected by CVE-2022-20621 via org.jenkins-ci.plugins:metrics (3.0.9)

org.jenkins-ci.plugins:metrics MAVEN version 3.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:metrics and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-1, =1.0-alpha-5, =1.0-alpha-8, =1.0-alpha-1, =1.0-alpha-1...

io.jenkins.blueocean:blueocean (>=1.0.0-b23, <=1.1.7), io.jenkins.blueocean:blueocean-config (>=1.0.0-b23, <=1.1.7) +12 more potentially affected by CVE-2022-20621 via org.jenkins-ci.plugins:metrics (3.1.2.9)

org.jenkins-ci.plugins:metrics MAVEN version 3.1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:metrics and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b23, =1.0.0-b23, =1.0.0-b23, =1.0.0-b23, =1.0.0-b23,...

com.cloudbees.jenkins.plugins:cloudbees-registration (3.15), io.jenkins.blueocean:blueocean-pipeline-editor (>=1.0-alpha-3, <=1.0-alpha-4) +3 more potentially affected by CVE-2021-21648 via org.jenkins-ci.plugins:credentials (1.23)

org.jenkins-ci.plugins:credentials MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudbees.jenkins.plugins:cloudbees-registration 3.15 -...

Privilege Escalation

jenkins-2-plugins/blueocean is vulnerable to privilege escalation. The vulnerability exists as the Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests...

Path Traversal

jenkins-2-plugins/blueocean is vulnerable to Path traversal vulnerability. It could allow to read arbitrary files...

Path traversal vulnerability in blueocean

blueocean 1.23.2 and earlier provides an undocumented feature flag, blueocean.features.GITREADSAVETYPE, that when set to the value clone allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system. blueocean 1.23.3 no longer...

CVE-2019-1003012

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js,...

CVE-2019-1003012: Cross-Site Request Forgery (CSRF)

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js,...

CVE-2019-1003013: Improper Neutralization of Input During Web Page Generation

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java,...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.2.0-beta-1) +19 more potentially affected by CVE-2019-1003002 via org.jenkinsci.plugins:pipeline-model-definition (>=0.1, <=1.3.2)

org.jenkinsci.plugins:pipeline-model-definition MAVEN version =0.1, =1.0.0-b02, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15, =0.1-preview-1, =2.0.7, =1.0, =1.1.0, =1.0.0, =1.5.5 and more Source cves: CVE-2019-1003002 Source advisory: MEND:CVE-2019-1003002...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-1, <=1.0.1) +14 more potentially affected by CVE-2017-1000087 via org.jenkins-ci.plugins:github-branch-source (>=1.3, <=2.0.6)

org.jenkins-ci.plugins:github-branch-source MAVEN version =1.3, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-4, =1.0-alpha-1, =1.3.0-alpha.1, =0.26, =1.0-beta-1, =1.0, =1.0-alpha-2, =1.0 - org.jenkins-ci.plugins:pipeline-github-lib...