aendter.jenkins.plugins:filesystem-list-parameter-plugin (=0.0.6), com.btc.ep:btc-embeddedplatform (>=1.9.2-beta <=2.5.9) +30 more potentially affected by CVE-2019-1003031 via org.jenkins-ci.plugins:matrix-project (>=1.0 <=1.13)

org.jenkins-ci.plugins:matrix-project MAVEN version =1.0, =1.9.2-beta, =0.5, =1.28, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.4.2, =0.34, =1.561, =1.599 - org.jenkins-ci.plugins:Matrix-sorter-plugin =1.3 - org.jenkins-ci.plugins:build-blocker-plugin =1.7.3 and more Source cves:...

RHEL 8 : OpenShift Container Platform 4.10.12 (RHSA-2022:1600)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1600 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Cross-site Scripting (XSS)

Overview org.jvnet.hudson.plugins:ci-game is a Jenkins Continuous Integration Game plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can inject arbitrary web script or HTML by sending a crafted request. Details Cross-site scripting or XSS is a code...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.plugins:violations is a plugin that generates reports on static code violations Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can inject arbitrary web script or HTML by sending a crafted request. Details Cross-site scripting or X...

org.jenkins-ci.plugins:buildgraph-view (>=1.3.1 <=1.8) potentially affected by CVE-2022-29049 via org.jenkins-ci.plugins:promoted-builds (=2.17)

org.jenkins-ci.plugins:promoted-builds MAVEN version =2.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:promoted-builds and may be impacted: - org.jenkins-ci.plugins:buildgraph-view =1.3.1, =1.8 Source cves: CVE-2022-29049...

org.jenkins-ci.plugins:buildgraph-view (>=1.3.1 <=1.8) potentially affected by CVE-2022-29045 via org.jenkins-ci.plugins:promoted-builds (=2.17)

org.jenkins-ci.plugins:promoted-builds MAVEN version =2.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:promoted-builds and may be impacted: - org.jenkins-ci.plugins:buildgraph-view =1.3.1, =1.8 Source cves: CVE-2022-29045...

CVE-2022-29044

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-29049

Jenkins promoted builds Plugin 873.v6149dbd64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name...

CVE-2022-29052

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-29050

A cross-site request forgery CSRF vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials...

PT-2022-19390 · Jenkins · Jenkins Publish Over Ftp Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over FTP Plugin versions 1.16 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an FTP server using attacker-specified credentials. Recommendations: For Jenkins Publish Over FTP...

CVE-2022-28155

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-28159

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-28157

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...

CVE-2022-28156

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...

CVE-2022-28149

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-28146

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

CVE-2022-28137

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2022-28135

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-28133

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create BitBucket Server consumers...