CVE-2020-2320

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads...

PT-2020-15554 · Jenkins · Jenkins Plugin Installation Manager Tool +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plugin Installation Manager Tool versions 2.1.3 and earlier Description: The issue is related to the Jenkins Plugin Installation Manager Tool not verifying plugin downloads, which may allow third parties to provide crafted plugin...

Cloudbees Jenkins 代码问题漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...

CVE-2020-2320: Download of Code Without Integrity Check

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads...

CVE-2020-2304

A flaw was found in the subversion Jenkins plugin. The XML parser is not properly configured to prevent XML external entity XXE attacks allowing an attacker the ability to control an agent process and have Jenkins parse a crafted changelog file that uses external entities for extraction of secret...

PT-2020-15530 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: The issue allows attackers to log in to Jenkins as any user by providing an empty password, depending on the configuration of the Active Directory server. This is possible...

PT-2020-15541 · Jenkins · Jenkins Aws Global Configuration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS Global Configuration Plugin versions 1.5 and earlier Description: A missing permission check in the Jenkins AWS Global Configuration Plugin allows attackers with Overall/Read permission to replace the global AWS configuration. Thi...

jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin

A flaw was found in the Matrix Authorization Strategy Plugin version 2.6.1 and prior. User names are not escaped in the permission table which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure, Job/Configure, or Overall/Administer permissions fo...

CVE-2020-2296

A cross-site request forgery CSRF vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects...

PT-2020-15516 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 3.0 and earlier Description: The issue arises from the improper invalidation of a permission cache when the configuration is changed, resulting in permissions being granted based on an...

PT-2020-15528 · Jenkins · Jenkins Nerrvana Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nerrvana Plugin versions 1.02.06 and earlier Description: The issue allows attackers to have Jenkins parse crafted HTTP requests with XML data, using external entities for extraction of secrets from the Jenkins controller or server-si...

PT-2020-15509 · Jenkins · Jenkins Warnings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Plugin versions 5.0.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to execute arbitrary code. This issue arises because the plugin does not require POST requests for a form...

XXE vulnerability in liquibase-runner

liquibase-runner 1.4.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from t...

CloudBees Jenkins Validating String Parameter Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2020-2269

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to configure views...

PT-2020-15482 · Jenkins · Jenkins Validating String Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Validating String Parameter Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Job/Configure permission. This occurs because the...

PT-2020-15496 · Jenkins · Jenkins Locked Files Report Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Locked Files Report Plugin versions 1.6 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because locked files' names in tooltips are not properly escaped. This can be exploite...

PT-2020-15489 · Jenkins · Jenkins Custom Job Icon Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Custom Job Icon Plugin versions 0.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the job descriptions in tooltips are not properly escaped. Attackers with...

OS command execution vulnerability in perfecto

perfecto allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in perfecto 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller. perfecto 1....

CloudBees Jenkins XXE Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A XXE vulnerability exists in...