CVE-2020-2269

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to configure views...

org.jenkins-ci.plugins:whitesource (>=20.1.2, <=21.1.2) potentially affected by CVE-2020-2252 via org.jenkins-ci.plugins:mailer (1.32)

org.jenkins-ci.plugins:mailer MAVEN version 1.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mailer and may be impacted: - org.jenkins-ci.plugins:whitesource =20.1.2, =21.1.2 Source cves: CVE-2020-2252 Source advisory:...

PT-2020-15482 · Jenkins · Jenkins Validating String Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Validating String Parameter Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Job/Configure permission. This occurs because the...

PT-2020-15496 · Jenkins · Jenkins Locked Files Report Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Locked Files Report Plugin versions 1.6 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because locked files' names in tooltips are not properly escaped. This can be exploite...

PT-2020-15489 · Jenkins · Jenkins Custom Job Icon Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Custom Job Icon Plugin versions 0.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the job descriptions in tooltips are not properly escaped. Attackers with...

OS command execution vulnerability in perfecto

perfecto allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in perfecto 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller. perfecto 1....

CloudBees Jenkins XXE Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A XXE vulnerability exists in...

PT-2020-15462 · Jenkins · Jenkins Database Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins database Plugin versions 1.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified database server using attacker-specified credentials. The vulnerability affects...

PT-2020-15468 · Jenkins · Jenkins Valgrind Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Valgrind Plugin versions 0.28 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not properly escape content in Valgrind XML reports. This allows attacke...

PT-2020-15470 · Jenkins · Jenkins Klocwork Analysis Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Klocwork Analysis Plugin versions 2020.2.1 and earlier Description: The issue concerns an XML external entity XXE attack. This occurs because the XML parser is not configured to prevent such attacks, allowing a user who can control th...

PT-2020-15474 · Readyapi +1 · Readyapi Functional Testing Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins SoapUI Pro Functional Testing Plugin versions 1.3 and earlier ReadyAPI Functional Testing Plugin versions 1.3 and earlier Description: The issue concerns the storage of project passwords in an unencrypted manner within job config.xml...

Cross site scripting

Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting XSS vulnerability exploitable by users with Run/Update permission...

PT-2020-15457 · Jenkins · Jenkins Yet Another Build Visualizer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Yet Another Build Visualizer Plugin versions 1.11 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the plugin does not escape tooltip content, allowing users with...

PT-2020-15420 · Jenkins · Jenkins Vncrecorder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VncRecorder Plugin versions 1.25 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the checkVncServ form validation endpoint does not escape a parameter value,...

PT-2020-15427 · Jenkins · Jenkins Github Coverage Reporter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Coverage Reporter Plugin versions 1.8 and earlier Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier Description: The issue concerns the storage of secrets in plain text in the global configuration file on the...

org.jfrog.hudson.ArtifactoryBuilder.xml Plugin Credentials Disclosure

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin involves the transmission of confidential information in open text. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials...

CVE-2020-2192

A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels...

PT-2020-15413 · Jenkins · Jenkins Subversion Partial Release Manager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Subversion Partial Release Manager Plugin versions 1.0.1 and earlier Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the error message for the repository URL field form validation...

PT-2020-15409 · Jenkins · Jenkins Compact Columns Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compact Columns Plugin versions 1.11 and earlier Description: The issue results in a stored cross-site scripting vulnerability. This can be exploited by users with Job/Configure permission, as the unprocessed job description is...

CloudBees Jenkins AWS SAM Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . AWS SAM Plugin is used in one of the...