Jenkins Git Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:2205 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

GHSA-38W4-Q97C-XH4X Cross-site Scripting in Jenkins Random String Parameter Plugin

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

GHSA-2XVX-RW9P-XGFC Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin

Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection. In Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier, any Groovy source files bundled with Jenkins core and plugins could ...

CVE-2022-30964

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

GHSA-3X9H-3P7M-33M7 Jenkins SonarQube Plugin Stores Passwords in Cleartext

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information cleartext passwords by reading the value in the sonar.sonarPassword parameter from jenkins/configure...

hudson.plugins.concurrent_login:concurrent-login-plugin (>=0.5 <=0.7), org.jenkins-ci.main:jenkins-test-harness (=1.513) +4 more potentially affected by CVE-2013-2034 via org.jenkins-ci.main:jenkins-core (=1.513)

org.jenkins-ci.main:jenkins-core MAVEN version =1.513 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - hudson.plugins.concurrentlogin:concurrent-login-plugin =0.5, =0.7 -...

GHSA-H52H-972R-68MH Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0 <=1.0.1) potentially affected by CVE-2017-1000090 via org.jenkins-ci.plugins:role-strategy (=2.1.0)

org.jenkins-ci.plugins:role-strategy MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:role-strategy and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =1.0.1 Source...

Jenkins Rundeck Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Rundeck Plugin 3.6.10 and earlier versions have a cross-site scripting...

PT-2022-20419 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins JDK Parameter Plugin version 1.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because the plugin does not...

PT-2022-20429 · Jenkins · Jenkins Storable Configs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Storable Configs Plugin versions 1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins parse a local XML file, such as archived artifacts, that uses external entities for...

org.jenkins-ci.plugins:php (=1.0) potentially affected by CVE-2018-1000010 via org.jvnet.hudson.plugins:dry (=2.33)

org.jvnet.hudson.plugins:dry MAVEN version =2.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.plugins:dry and may be impacted: - org.jenkins-ci.plugins:php =1.0 Source cves: CVE-2018-1000010 Source advisory: OSV:GHSA-X7QF-QH3R-MX22...

org.jenkins-ci.plugins:php (=1.0) potentially affected by CVE-2018-1000175 via org.jenkins-ci.plugins:htmlpublisher (=1.0)

org.jenkins-ci.plugins:htmlpublisher MAVEN version =1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:htmlpublisher and may be impacted: - org.jenkins-ci.plugins:php =1.0 Source cves: CVE-2018-1000175 Source advisory:...

org.jenkins-ci.plugins:vectorcast-execution (>=0.16 <=0.61) potentially affected by CVE-2018-1000202 via org.jvnet.hudson.plugins:groovy-postbuild (=2.3)

org.jvnet.hudson.plugins:groovy-postbuild MAVEN version =2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.plugins:groovy-postbuild and may be impacted: - org.jenkins-ci.plugins:vectorcast-execution =0.16, =0.61 Source cves:...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +698 more potentially affected by CVE-2012-6073 via org.jenkins-ci.main:jenkins-core (>=1.396 <=1.480)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.9, =1.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =0.1, =0.1, =0.17 and more Source cves: CVE-2012-6073 Source advisory: SNYK:JAVA-ORGJENKINSCIMAIN-9404543...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +771 more potentially affected by CVE-2013-2033 via org.jenkins-ci.main:jenkins-core (>=1.396 <=1.509)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.9, =1.0, =1.0.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =1.0, =1.0, =1.2 - com.cloudbees.jenkins.plugins:cloudbees-credentials =3.3 and more Source cves: CVE-2013-2033 Source advisory: OSV:GHSA-826F-32QM-VM3J...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +1598 more potentially affected by CVE-2017-2608 via org.jenkins-ci.main:jenkins-core (>=1.396 <=2.32.1)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.0.1, =1.0, =1.0, =0.0.1, =0.1.0, =1.0, =0.9, =1.3, =1.0.5.0, =1.0.6.1 and more Source cves: CVE-2017-2608 Source advisory: OSV:GHSA-FWQR-3PVP-PJWQ...

GHSA-8XR3-54W2-8XJP Jenkins Image Gallery Plugin allows Path Traversal

Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields...

org.jenkins-ci.plugins:global-slack-notifier (>=1.0 <=1.3) potentially affected by CVE-2019-1003044 via org.jenkins-ci.plugins:slack (=2.2)

org.jenkins-ci.plugins:slack MAVEN version =2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:slack and may be impacted: - org.jenkins-ci.plugins:global-slack-notifier =1.0, =1.3 Source cves: CVE-2019-1003044 Source advisory:...