267 matches found
Missing permission checks in sauce-ondemand allow enumerating credentials IDs
sauce-ondemand 2.2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
PT-2026-55157
Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to trigger a build for a pull request. GitHub Integration Plugin 0.7.4 requires POST requests...
CVE-2022-23110
Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission...
CVE-2022-27204
A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers to connect to an attacker-specified URL...
CVE-2022-27209
A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
CVE-2019-16551
A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials...
CVE-2024-2216
A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...
CSRF vulnerability in extensible-choice-parameter
extensible-choice-parameter 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute sandboxed Groovy code. As of publication of this advisory, there is no fix...
EUVD-2013-6198
Malware in sbrugna...
EUVD-2014-3627
Malware in sbrugna...
EUVD-2021-1426
Malware in sbrugna...
EUVD-2023-1703
Malicious code in bioql PyPI...
EUVD-2023-2581
Malicious code in bioql PyPI...
EUVD-2022-1899
Malicious code in bioql PyPI...
EUVD-2022-6390
Malicious code in bioql PyPI...
EUVD-2025-20847
Malicious code in bioql PyPI...
EUVD-2022-6002
Malicious code in bioql PyPI...
EUVD-2022-7109
Malicious code in bioql PyPI...