1782 matches found
zaproxy
The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...
CVE-2025-53652-Jenkins-Git-Parameter-Analysis
CVE-2025-53652: Jenkins Git Parameter Plugin의 검증되지 않은 입력 취약점. 요약 이 취약점은 Jenkins 빌드 파라미터의 사용자 제어 입력이 Git 체크아웃 명령에 안전하지 않게 주입되기 때문에 발생합니다. 사용자 입력은 빌드 파라미터예: gitParameters로 제공되며, 여기에는 악의적인 셸 명령이 포함될 수 있습니다. 이 파라미터는 GitParameterValueStringParameterValue를 확장로 래핑되며, 해당 GitParameterValue의 buildEnvironme...
jenkinsci__workflow-multibranch-plugin_CVE-2022-25175_706-vd43c65dec013
Pipeline: Multibranch 소개 Pipeline 플러그인이 서로 다른 브랜치의 빌드를 자동으로 그룹화하여 브랜치를 더 잘 처리할 수 있도록 향상시킵니다. 새 브랜치가 소스 코드 저장소에 푸시될 때마다 새 Jenkins 작업을 자동으로 생성합니다. 다른 플러그인은 Git 브랜치, Subversion 브랜치, GitHub Pull Request 등 다양한 브랜치 유형을 정의할 수 있습니다. 자세한 내용은 이 블로그 게시물을 참조하세요:...
jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d
파이프라인 공유 라이브러리 여러 개의 파이프라인 작업이 있을 때, 파이프라인 스크립트를 DRY하게 유지하기 위해 스크립트의 일부를 공유하고 싶은 경우가 많습니다. 매우 일반적인 사용 사례는 비슷한 방식으로 빌드되는 많은 프로젝트가 있는 경우입니다. 이 플러그인은 '공유 라이브러리 스크립트' SCM 저장소를 생성할 수 있도록 하여 해당 기능을 추가합니다. 두 가지 모드로 사용할 수 있습니다: Jenkins 자체에서 호스팅하는 단일 Git 저장소가 있어 변경 사항을 푸시할 수 있는 레거시 모드 원하는 위치의 모든 SCM에서 호스팅...
CVE-2026-84676
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...
CVE-2026-84676
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...
CVE-2026-84674
The Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) is vulnerable to a missing permission check in several HTTP endpoints. This flaw allows users with Overall/Read permissions to enumerate credentials IDs for credentials stored in Jenkins. Attackers can leverage these identified I...
CVE-2026-84666
Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...
CVE-2026-84666
The Jenkins Job Configuration History Plugin (version 1367.vc8fa_b_15101dc and earlier) is vulnerable to improper input validation via Stapler data binding . The plugin's constructor used the @DataBoundConstructor annotation, which allowed the Stapler web framework to invoke @DataBoundSetter meth...
CVE-2026-84666
Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...
PT-2026-84799
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...
Tokens stored in plain text by Parameterized-Remote-Trigger
Parameterized-Remote-Trigger 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of thi...
PT-2026-84795
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0b ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
Improper access control in script-security
Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...
Stored XSS vulnerability in sonar
sonar 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. TIP: On Jenkins 2.53...
Improper access control in customizable-header leads to XSS
Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...
PT-2026-84789
Jenkins Job Configuration History Plugin 1367.vc8fa b 15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...
Improper access control in saml
Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments. saml 4.618.v441a27fa46d2 and...
Path traversal vulnerability in allure-jenkins-plugin
allure-jenkins-plugin 2.35.2 and earlier does not correctly validate file paths when serving Allure report results. This allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system. allure-jenkins-plugin...