Jenkins Plugin Favorite View 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin Favorite...

CVE-2023-40351: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Favorite View Plugin 5.v77a37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar...

PT-2023-27408

Name of the Vulnerable Software and Affected Versions Jenkins Favorite View Plugin versions 5.v77a 37f62782d and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to add or remove views from another user's favorite views tab bar. This issue arises because the...

CSRF vulnerability in favorite-view

favorite-view 5.v77a37f62782d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to add or remove views from another user's favorite views tab bar. As of publication of this advisory,...

Top Security Talks from KubeCon Europe 2023

KubeCon Europe is the largest open-source community conference in Europe with hundreds of talks. We picked our favorite Kubernetes security sessions available online...

[Security Nation] Jen and Tod on Hacker Summer Camp 2022

!\Security Nation\ Jen and Tod on Hacker Summer Camp 2022https://blog.rapid7.com/content/images/2022/08/securitynationlogo-1.jpg In this episode of Security Nation, Tod and Jen chat about their experience at this year’s Hacker Summer Camp, the multi-event lineup of cybersecurity conferences in La...

Google Android 权限许可和访问控制问题漏洞

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has a security vulnerability that could be exploited by attackers to delete Fdn contacts...

Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification...

GHSA-JQWH-JRPG-5J3H Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification...

io.jenkins.blueocean:blueocean (>=1.0.0-b12, <=1.1.0-beta-9), io.jenkins.blueocean:blueocean-config (>=1.0.0-b13, <=1.0.1) +9 more potentially affected by CVE-2017-1000244 via org.jvnet.hudson.plugins:favorite (>=2.0, <=2.0.4)

org.jvnet.hudson.plugins:favorite MAVEN version =2.0, =1.0.0-b12, =1.0.0-b13, =1.0.0-b12, =1.0.0-b12, =1.0.0-b15, =1.0.0-b15, =1.0.0-b12, =1.0.0-b12, =0.1-preview-4, =1.0.0-b12, =0.1, =1.0.0 Source cves: CVE-2017-1000244 Source advisory: GHSA-JQWH-JRPG-5J3H...

io.jenkins.blueocean:blueocean (>=1.0.0-b12, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-config (>=1.0.0-b13, <=1.0.1) +9 more potentially affected by CVE-2017-1000244 via org.jvnet.hudson.plugins:favorite (>=2.0, <=2.3.1)

org.jvnet.hudson.plugins:favorite MAVEN version =2.0, =1.0.0-b12, =1.0.0-b13, =1.0.0-b12, =1.0.0-b12, =1.0.0-b15, =1.0.0-b15, =1.0.0-b12, =1.0.0-b12, =0.1-preview-4, =1.0.0-b12, =0.1, =1.0.0 Source cves: CVE-2017-1000244 Source advisory: OSV:GHSA-JQWH-JRPG-5J3H...

GHSA-268V-2QQ7-84PF Missing permission check in Jenkins Favorite Plugin

Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites...

Missing permission check in Jenkins Favorite Plugin

Jenkins Favorite Plugin up to and including 2.1.0 does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

GHSA-874R-46C6-7P4R Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

CVE-2022-27196

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...

Cross site scripting

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions...