Jenkins JUnit Plugin Cross-Site Scripting (CVE-2022-34176)

A stored cross-site scripting vulnerability exists in Jenkins JUnit Plugin. The vulnerability is due to the JUnit plugin not escaping the description parameter of the build run test result...

org.jenkins-ci.plugins:extreme-notification (>=1.5, <=1.6), org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.5, <=0.6) +1 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins:script-security (1.33)

org.jenkins-ci.plugins:script-security MAVEN version 1.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extreme-notification =1.5, =0.5, =3.4.0-beta-1, =3.5.12 Sourc...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3), org.jenkins-ci.plugins.workflow:workflow-cps (>=2.37, <=2.38) +3 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins:script-security (1.30)

org.jenkins-ci.plugins:script-security MAVEN version 1.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =2.37, =1.22-beta-1, =1.10, =1.5, =1.6 Source...

org.jenkins-ci.plugins:extreme-notification (>=1.5, <=1.6), org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.5, <=0.6) +1 more potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.33)

org.jenkins-ci.plugins:script-security MAVEN version 1.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extreme-notification =1.5, =0.5, =3.4.0-beta-1, =3.5.12 Sourc...

org.jenkins-ci.plugins:extreme-notification (>=1.5, <=1.6), org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.5, <=0.6) +1 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins:script-security (1.33)

org.jenkins-ci.plugins:script-security MAVEN version 1.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extreme-notification =1.5, =0.5, =3.4.0-beta-1, =3.5.12 Sourc...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3), org.jenkins-ci.plugins.workflow:workflow-cps (>=2.37, <=2.38) +3 more potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.30)

org.jenkins-ci.plugins:script-security MAVEN version 1.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =2.37, =1.22-beta-1, =1.10, =1.5, =1.6 Source...

jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin

A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website...

This Week in Spring - September 13th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Weve got a lot of good stuff to get to so lets dive right into it! A Bootiful Podcast: Hashicorps Rosemary Wang on securing the intersection of apps and ops with Hashicorp Vault a nice video by my colleague Dan Vega: Spring...

Jenkins LTS < 2.332.4 / Jenkins weekly < 2.356 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.332.4 or Jenkins weekly prior to 2.356. It is, therefore, affected by multiple vulnerabilities: - Multiple cross-site scripting XSS vulnerabilities in Jenkins 2.355...

Jenkins plugins Multiple Vulnerabilities (2022-06-22)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Multiple cross-site scripting XSS vulnerabilities in Jenkins 2.355 and earlier, LTS 2.332.3 and earlier allow attackers to inject HTML and...

junit4: TemporaryFolder is shared between all users across system which could result in information disclosure

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...

CVE-2022-34176

A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website...

This Week in Spring - June 28th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Im writing this from the Big Apple, New York City! Im here for the SpringOne Tour 2022 NYC event. This is my first time back in New York City since before the pandemic and it has been so much fun. Ive been catching up with...

GHSA-64MJ-3P92-589V Cross-site Scripting in Jenkins JUnit Plugin

JUnit Plugin 1119.vaa5e9068dad7 and earlier does not escape descriptions of test results. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Run/Update permission. JUnit Plugin 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptio...

org.jenkins-ci.plugins:parallel-test-executor (1.6-beta-1) potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.2-beta-1)

org.jenkins-ci.plugins:junit MAVEN version 1.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:parallel-test-executor 1.6-beta-1 Source cves: CVE-2022-34176 Source...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), com.smalltest:smalltest (>=1.0.1, <=1.0.4) +32 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.20)

org.jenkins-ci.plugins:junit MAVEN version 1.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin 0.0.6 - com.smalltest:smalltest =1.0.1, =1.28,...

io.jenkins.blueocean:blueocean-config (>=1.2.0-beta-5, <=1.2.4), io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-5, <=1.2.4) +6 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.21)

org.jenkins-ci.plugins:junit MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - io.jenkins.blueocean:blueocean-config =1.2.0-beta-5, =1.2.0-beta-5, =1.2.0-beta-5, =bn, =1.3.0, =1.179,...

org.jenkins-ci.plugins:parallel-test-executor (>=1.10, <=1.12) potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.22)

org.jenkins-ci.plugins:junit MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:parallel-test-executor =1.10, =1.12 Source cves: CVE-2022-34176 Source advisory:...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3) potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.23)

org.jenkins-ci.plugins:junit MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =1.3 Source cves: CVE-2022-34176 Source advisory:...

org.jenkins-ci.plugins:continuum (1.0.1), org.jenkins-ci.plugins:flaky-test-handler (>=1.0.1, <=1.0.4) +2 more potentially affected by CVE-2022-34176 via org.jenkins-ci.plugins:junit (1.4)

org.jenkins-ci.plugins:junit MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkins-ci.plugins:continuum 1.0.1 - org.jenkins-ci.plugins:flaky-test-handler =1.0.1, =0.12, =0.23...