Jenkins SSH Plugin Permissions and Access Control Issues Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.The Jenkins SSH Plugin 2.6.1 and earlier...

Jenkins Git Plugin Information Disclosure Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...

RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:2205 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Jenkins Blue Ocean Access Control Error Vulnerability

Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Blue Ocean 1.25.3 and earlier versions are vulnerable to an acces...

GHSA-38W4-Q97C-XH4X Cross-site Scripting in Jenkins Random String Parameter Plugin

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +3 more potentially affected by CVE-2022-30948 via org.jenkins-ci.plugins:mercurial (>=2.0-alpha-1, <=2.1)

org.jenkins-ci.plugins:mercurial MAVEN version =2.0-alpha-1, =2.2.0-alpha-1, =1.1.3, =1.0.0, =1.0.2 Source cves: CVE-2022-30948 Source advisory: OSV:GHSA-5786-3QJG-MR88...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +3 more potentially affected by CVE-2022-30947 via org.jenkins-ci.plugins:mercurial (>=2.0-alpha-1, <=2.1)

org.jenkins-ci.plugins:mercurial MAVEN version =2.0-alpha-1, =2.2.0-alpha-1, =1.1.3, =1.0.0, =1.0.2 Source cves: CVE-2022-30947 Source advisory: GHSA-84CM-VJWM-M979...

org.jenkins-ci.plugins:bitbucket (>=1.1.4, <=1.1.13), org.jenkins-ci.plugins:bitbucket-build-status-notifier (>=1.1.0, <=1.4.2) +2 more potentially affected by CVE-2022-30947 via org.jenkins-ci.plugins:mercurial (1.54)

org.jenkins-ci.plugins:mercurial MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins:bitbucket =1.1.4, =1.1.0, =1.3, =1.1.0, =1.1.2 Source cves: CVE-2022-3094...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +3 more potentially affected by CVE-2022-30947 via org.jenkins-ci.plugins:mercurial (>=2.0-alpha-1, <=2.1)

org.jenkins-ci.plugins:mercurial MAVEN version =2.0-alpha-1, =2.2.0-alpha-1, =1.1.3, =1.0.0, =1.0.2 Source cves: CVE-2022-30947 Source advisory: OSV:GHSA-84CM-VJWM-M979...

org.jenkins-ci.plugins:pretested-integration (1.0.0) potentially affected by CVE-2022-30948 via org.jenkins-ci.plugins:mercurial (1.38)

org.jenkins-ci.plugins:mercurial MAVEN version 1.38 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins:pretested-integration 1.0.0 Source cves: CVE-2022-30948 Source advisory:...

GHSA-2XVX-RW9P-XGFC Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin

Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection. In Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier, any Groovy source files bundled with Jenkins core and plugins could ...

CVE-2022-30964

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

GHSA-3X9H-3P7M-33M7 Jenkins SonarQube Plugin Stores Passwords in Cleartext

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information cleartext passwords by reading the value in the sonar.sonarPassword parameter from jenkins/configure...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (>=1.597, <=1.599) +10 more potentially affected by CVE-2015-1810 via org.jenkins-ci.main:jenkins-core (>=1.597, <=1.599)

org.jenkins-ci.main:jenkins-core MAVEN version =1.597, =1.597, =1.597, =0.0.2, =1.2.0, =0.14.0, =1.0, =1.597, =1.17, =1.0, =1.0.0, =4.0, =4.2 Source cves: CVE-2015-1810 Source advisory: OSV:GHSA-37WM-28RM-56VW...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (>=1.597, <=1.599) +10 more potentially affected by CVE-2015-1808 via org.jenkins-ci.main:jenkins-core (>=1.597, <=1.599)

org.jenkins-ci.main:jenkins-core MAVEN version =1.597, =1.597, =1.597, =0.0.2, =1.2.0, =0.14.0, =1.0, =1.597, =1.17, =1.0, =1.0.0, =4.0, =4.2 Source cves: CVE-2015-1808 Source advisory: OSV:GHSA-3RWX-3VWH-MWXC...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-test-harness (>=1.597, <=1.599) +10 more potentially affected by CVE-2015-1808 via org.jenkins-ci.main:jenkins-core (>=1.597, <=1.599)

org.jenkins-ci.main:jenkins-core MAVEN version =1.597, =1.597, =1.597, =0.0.2, =1.2.0, =0.14.0, =1.0, =1.597, =1.17, =1.0, =1.0.0, =4.0, =4.2 Source cves: CVE-2015-1808 Source advisory: GHSA-3RWX-3VWH-MWXC...

GHSA-H52H-972R-68MH Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

org.jenkins-ci.plugins:git (1.6.0-beta-1) potentially affected by CVE-2017-1000242 via org.jenkins-ci.plugins:git-client (1.2.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git 1.6.0-beta-1 Source cves: CVE-2017-1000242 Source advisory:...

Jenkins Rundeck Plugin Cross-Site Script Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. Jenkins Rundeck Plugin 3.6.10 and earlier versions have a cross-site scripting...

PT-2022-20419 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins JDK Parameter Plugin version 1.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because the plugin does not...