155 matches found
Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...
GHSA-C3JM-9VJ7-5V66 Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...
GHSA-CFJ9-2VGR-HPXP Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...
CVE-2026-57280: Protection Mechanism Failure
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection...
CVE-2026-57281: Improper Neutralization of CRLF Sequences
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...
Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths
Jenkins Script Security Plugin versions 1399.ve6a66547f6e1 and earlier do not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. Script Security Plugin 1402.v94c9ce464861 requires...
CVE-2026-42519: Missing Authorization
A missing permission check in Jenkins Script Security Plugin 1399.ve6a66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths...
EUVD-2022-5137
Malicious code in bioql PyPI...
EUVD-2022-2690
Malicious code in bioql PyPI...
EUVD-2022-4680
Malicious code in bioql PyPI...
EUVD-2022-4918
Malicious code in bioql PyPI...
EUVD-2022-6986
Malicious code in bioql PyPI...
EUVD-2022-7052
Malicious code in bioql PyPI...
EUVD-2022-7088
Malicious code in bioql PyPI...
EUVD-2022-3365
Malicious code in bioql PyPI...
EUVD-2022-2891
Malicious code in bioql PyPI...
EUVD-2024-1357
Malicious code in bioql PyPI...
EUVD-2022-4221
Malicious code in bioql PyPI...
CVE-2024-52549
The Jenkins Script Security Plugin (version 1367.vdf2fc45f229c and earlier, excluding specific versions 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776) is vulnerable to a file disclosure flaw. The root cause is a missing permission check in a method used for form validation, which allow...
CVE-2024-52549
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the...