Cross site scripting

Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

Cross site scripting

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2206

The CVE-2020-2206 entry concerns Jenkins VncRecorder Plugin versions 1.25 and earlier. Affected component: the checkVncServ form validation endpoint, which does not escape a parameter value, causing a reflected XSS vulnerability. Root cause: inadequate escaping in the endpoint’s output. Practical...

CSRF vulnerability and missing permission checks in zephyr-for-jira-test-management

zephyr-for-jira-test-management 1.5 and earlier does not perform a permission check in a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified host using attacker-specified username and password. Additionally, this form...

CVE-2020-2207: Improper Neutralization of Input During Web Page Generation

Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

Reflected XSS vulnerability in vncviewer

vncviewer 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output. This results in a reflected cross-site scripting XSS vulnerability. vncviewer 1.8 escapes the parameter value in the output...

CVE-2020-2206: Improper Neutralization of Input During Web Page Generation

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

jenkins-git-plugin: stored cross-site scripting

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability...

jenkins-git-plugin: stored cross-site scripting

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2200

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2200

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2200: Improper Neutralization of Special Elements used in an OS Command

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2199: Improper Neutralization of Input During Web Page Generation

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability...

OS command injection vulnerability in Play Framework

A form validation endpoint in Play Framework executes the play command to validate a given input file. Play Framework 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to sto...

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019

The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...

CVE-2019-10310

A flaw was found in ansible-tower. Form validation methods allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, leading to a cross-site request forgery vulnerability...

CVE-2020-2174

Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-site scripting vulnerability...

Cross site scripting

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

CVE-2020-2176

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

PT-2020-15389 · Usemango +1 · Usemango Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: useMango Runner Plugin versions 1.4 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. Multiple form validation endpoints in the useMango Runner Plugin do not escape values received from the useMango...