CVE-2020-2113: Improper Neutralization of Input During Web Page Generation

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission...

PT-2020-15319 · Jenkins · Jenkins Git Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Git Parameter Plugin versions 0.9.11 and earlier Description: The issue results in a stored cross-site scripting vulnerability. It is exploitable by users with Job/Configure permission due to the parameter name not being escaped on th...

CVE-2020-2124: Insufficiently Protected Credentials

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2112: Improper Neutralization of Input During Web Page Generation

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0-beta-1, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0-beta-1, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2014-0050 Source advisory: OSV:GHSA-XX68-JFCG-XMMF...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8) +23046 more potentially affected by CVE-2014-0114 via commons-beanutils:commons-beanutils (>=1.8.0, <=1.9.3)

commons-beanutils:commons-beanutils MAVEN version =1.8.0, =0.0.1, =1.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =thread-pool-0.0.24-dev, =0.0.6, =0.1.12, =0.0.2, =0.7.0,...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2014-0050 Source advisory: MEND:CVE-2014-0050...