194 matches found
Maven Integration Plugin did not mask sensitive values in module build logs
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log...
GHSA-42M6-7XFF-9V9M Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins before versions 2.44 and 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes SECURITY-382. Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins...
GHSA-VMP5-C5HP-6C65 Woodpecker allows cross-site scripting (XSS) via build logs
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
Woodpecker allows cross-site scripting (XSS) via build logs
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
Cross site scripting
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
CVE-2022-29947
CVE-2022-29947 affects Woodpecker (Woodpecker CI) prior to version 0.15.1. Root cause: missing escaping in web/src/components/repo/build/BuildLog.vue enables cross-site scripting via build logs. Impact: XSS in the client when rendering build logs. Mitigation: upgrade to Woodpecker v0.15.1 (as doc...
CVE-2022-29947
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping...
PT-2022-19928 · Unknown · Woodpecker
Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 0.15.1 Description: The issue allows cross-site scripting XSS via build logs because the BuildLog.vue component in web/src/components/repo/build lacks proper escaping. This can lead to the execution of malicious...
CVE-2022-23109
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...
CVE-2020-2312
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
Default credentials
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
CVE-2020-2312
Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs...
PT-2020-15542 · Jenkins · Jenkins Sqlplus Script Runner Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins SQLPlus Script Runner Plugin versions 2.0.12 and earlier Description: The issue concerns the Jenkins SQLPlus Script Runner Plugin, where a password provided as a command line argument is not masked in build logs. This allows users wit...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...