CVE-2024-52552: Improper Neutralization of Input During Web Page Generation

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (0.3), org.jenkins-ci.main:jenkins-test-harness (1.554.3) +34 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.554.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.554.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin 0.3 -...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (0.3), org.jenkins-ci.main:jenkins-test-harness (1.554.3) +34 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.554.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.554.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin 0.3 -...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.5, <=0.5.1), com.piketec.jenkins.plugins:piketec-tpt (>=6.4, <=8.8) +36 more potentially affected by CVE-2024-43045 via org.jenkins-ci.main:jenkins-core (1.625.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.5, =6.4, =2.4.3, =2.4.3,...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (0.3), org.jenkins-ci.main:jenkins-test-harness (1.554.3) +34 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.554.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.554.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin 0.3 -...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.5, <=0.5.1), com.piketec.jenkins.plugins:piketec-tpt (>=6.4, <=8.8) +36 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.625.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.5, =6.4, =2.4.3, =2.4.3,...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7) +139 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.53.3)

org.jenkins-ci.main:remoting MAVEN version 2.53.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =0.6, =1.4, =0.1, =1.2.1, =1.2.4, =1.0, =1.0.3, =1.0.14,...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), com.groupon.jenkins-ci.plugins:dotci (>=2.37.0, <=2.40.00) +18 more potentially affected by CVE-2024-39458 via org.jenkins-ci.plugins:structs (1.4)

org.jenkins-ci.plugins:structs MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:structs and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =2.37.0, =1.0.0-b02,...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

GHSA-CJGM-9VC9-56MX Path traversal vulnerability in Jenkins Matrix Project Plugin

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins...

Path traversal vulnerability in Jenkins Matrix Project Plugin

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-23900

CVE-2024-23900 affects Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier. The flaw: the plugin does not sanitize user-defined axis names for multi-configuration projects, allowing attackers with Item/Configure permission to write or replace config.xml files on the Jenkins controller fi...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-23900

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...