Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4426-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4426-1 advisory. Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict loading SSDT code from an EFI...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4425-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4425-1 advisory. It was discovered that the network block device nbd implementation in the Linux kernel did not properly check for error conditions in some...

Debian: Security Advisory (DLA-2278-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Jenkins

Several vulnerabilities have been fixed in Jenkins. A malicious user could potentially exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. A such an attack can lead to the execution of arbitrary script code in the browser used to visit the application. Jenkins developers hav...

CVE-2020-2223

A flaw was found in Jenkins versions 2.244 and prior and in LTS 2.235.1 and prior. HREF attribute of links to downstream jobs are not escaped on build console pages which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

CVE-2020-2221

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2222

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2223

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2220

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2223

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2223

CVE-2020-2223 describes a stored XSS in Jenkins where links to downstream jobs displayed on the build console page do not escape the href attribute. Affected products: Jenkins 2.244 and earlier, and OpenJDK LTS 2.235.1 and earlier. The issue allows injection of script code via crafted hrefs in th...

CVE-2020-2221

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2221

CVE-2020-2221 affects Jenkins 2.244 and earlier (including LTS 2.235.1 and earlier). The root cause is a stored XSS in the upstream build cause display name that is not escaped, leading to cross-site scripting. The issue is addressed in Jenkins 2.245 and later; upgrading to a supported version re...

CVE-2020-2221

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2220

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability...

CVE-2020-2222

CVE-2020-2222 affects Jenkins 2.244 and earlier (LTS 2.235.1 and earlier): the 'Keep this build forever' badge tooltip does not escape the job name, enabling stored XSS. Mitigation: upgrade to Jenkins 2.245 or LTS 2.235.2, which fixes the issue. Connected advisories corroborate the stored XSS ris...

CVE-2020-2220

CVE-2020-2220 affects Jenkins 2.244 and earlier, and LTS 2.235.1 and earlier, due to a stored XSS in the build time trend page caused by the agent name not being escaped. The issue is documented across multiple sources (OSV for this CVE and related advisories), confirming the vulnerable component...