45 matches found
jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...
Cross site scripting
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...
jenkins: Project name disclosure via fingerprints (SECURITY-153)
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...
CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2015-07827)
CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 or earlier, a security vulnerability exists in the Fingerprints page, which allows a remote attacker to obtain sensitive job and build name information through a direct request...
