cve-2019-1003000-jenkins-rce-poc

PoC: Jenkins RCE SECURITY-1266 / CVE-2019-1003000 Script Security, CVE-2019-1003001 Pipeline: Groovy, CVE-2019-1003002 Pipeline: Declarative Una prueba de concepto que permite a usuarios con permiso Overall/Read y Job/Configure y opcionalmente Job/Build eludir la protección del sandbox y ejecutar...

Jenkins_CVE-2019-1003000

Vulnerabilidad de ejecución remota de código del plugin JenkinsScript-SecurityPipeline CVE-2019-1003000 versión pocsuite...

jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

Script Security Plugin Guía del usuario adaptado de la información sobre Template plugin en la guía de CloudBees Plugins Varios complementos de Jenkins requieren que los usuarios definan scripts personalizados, más comúnmente en el lenguaje Groovy, para personalizar el comportamiento de Jenkins. ...

CVE-2026-92125

A flaw was found in the Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, such as Pipelines, can exploit this vulnerability. By not properly rejecting the @GroovyASTTransformationClass annotation, an attacker can run an arbitrary Abstract Syntax Tree...

Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through improper handling of collection type casting...

Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through the execution of unintercepted operations...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection in the @GroovyASTTransformationClass annotation...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of @Builder annotations when the...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection via the automatic approval of classpath entries in...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-92122

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92129

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92123

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92128

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...

CVE-2026-92128

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...