CVE-2021-22513

CVE-2021-22513 is a real-world vulnerability affecting the Micro Focus Application Automation Tools Plugin for Jenkins, version 6.7 and earlier. The root cause is missing authorization checks in form-validation methods, enabling attackers with Overall/Read permission to access attacker-specified ...

CVE-2021-22513

Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks...

CVE-2021-22511: Improper Certificate Validation

Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates...

CVE-2021-22512: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...

CVE-2021-22510: Improper Neutralization of Input During Web Page Generation

Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions...

CVE-2021-22513: Missing Authorization

Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without permission checks...

CVE-2021-21629

A cross-site request forgery CSRF vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters...

PT-2021-14678 · Jenkins · Jenkins Rest List Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins REST List Parameter Plugin versions 1.3.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability due to the failure to escape a parameter name reference in embedded JavaScript. This vulnerability...

PT-2021-14677 · Jenkins · Jenkins Jabber (Xmpp) Notifier/Control Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Jabber XMPP notifier and control Plugin versions 1.41 and earlier Description: The issue concerns the storage of passwords in the global configuration file on the Jenkins controller. Specifically, passwords are stored unencrypted in t...

PT-2021-14681 · Jenkins · Jenkins Team Foundation Server Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing...

Jenkins Team Foundation Server 跨站请求伪造漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

CVE-2021-21626

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

PT-2021-14667 · Oracle +1 · Java +1

Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 3.1 and earlier Description: The issue arises from an incorrect permission check, allowing attackers with Item/Read permission on nested items to access them even if they lack Item/Rea...

Jenkins Role-based Authorization Strategy 权限许可和访问控制问题漏洞

Jenkins Role-based Authorization Strategy is Jenkins open source an application plugin . The plugin is used to add a new role-based mechanism to manage user rights . A privilege impropriety vulnerability exists in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier versions. An...

Cross site scripting

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...

jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin

Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables...

Cloudbees Jenkins TraceTronic ECU-TEST Plugin Information Disclosure Vulnerability

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . An information disclosure...

CVE-2021-21614

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2020-2324

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2020-2323

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...