CVE-2018-1000190

A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

PT-2018-9355

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Pull Request Builder Plugin versions 1.41.0 and older Description A sensitive information exposure issue exists, allowing attackers with Overall/Read access to connect to a specified URL using attacker-specified credentials IDs,...

CVE-2018-1000190: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method...

CVE-2018-1000185: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL...

CVE-2018-1000189: Undefined Security Weakness

A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master...

CVE-2018-1000186: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another...

CVE-2018-1000188: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL...

PT-2018-9360

Name of the Vulnerable Software and Affected Versions Jenkins Black Duck Detect Plugin versions 1.4.0 and older Description A sensitive information exposure issue exists, allowing attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs,...

PT-2018-9351

Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin version 3.9.0 and older Description A server-side request forgery issue exists that allows attackers with Overall/Read access to cause the system to send a GET request to a specified URL. This is due to vulnerabilities in...

PT-2018-9358

Name of the Vulnerable Software and Affected Versions Jenkins Absint Astree Plugin versions 1.0.5 and older Description A command execution issue exists in the AstreeBuilder.java file, allowing attackers with Overall/Read access to execute commands on the Jenkins master. Recommendations For Jenki...

CVE-2018-1000191: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth...

PT-2018-9353

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Plugin versions 1.29.0 and older Description A server-side request forgery issue exists that allows attackers with Overall/Read access to cause the server to send a GET request to a specified URL. This is due to a vulnerability ...

FreeBSD : jenkins -- multiple vulnerabilities (06ab7724-0fd7-427e-a5ce-fe436302b10c)

Jenkins developers report : The agent to master security subsystem ensures that the Jenkins master is protected from maliciously configured agents. A path traversal vulnerability allowed agents to escape whitelisted directories to read and write to files they should not be able to access. Black...

CVE-2018-1000105

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

PT-2018-9285

Name of the Vulnerable Software and Affected Versions: Jenkins Gerrit Trigger Plugin versions 2.27.4 and earlier Description: An improper authorization issue exists that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins. This issue is related to the...

CVE-2017-1000086

The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to it...

CVE-2017-1000086

Summary: Multiple sources report a vulnerability in the Jenkins Periodic Backup Plugin (CVE-2017-1000086) involving missing permission checks and CSRF exposure. Affected component: Jenkins Periodic Backup Plugin (version 1.4 and earlier, per CNVD/CVE references). Root cause (as stated): The plugi...