GHSA-CPW3-X7GF-P872 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to...

jenkins: view name validation bypass

A flaw was found in Jenkins. Due to lack of validation of the newly created view name, an attackers with View/Create permission are allowed to create views with invalid or already-used names...

jenkins: view name validation bypass

A flaw was found in Jenkins. Due to lack of validation of the newly created view name, an attackers with View/Create permission are allowed to create views with invalid or already-used names...

Jenkins 安全漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

PT-2021-14683 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.286 and earlier Jenkins LTS versions 2.277.1 and earlier Description: The issue arises from the improper validation of newly created view names, allowing attackers with View/Create permission to create views with invalid or...

CVE-2020-2269

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to configure views...

PT-2020-15494 · Jenkins · Jenkins Chosen-Views-Tabbar Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins chosen-views-tabbar Plugin versions 1.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because view names in the dropdown to select views are not properly escaped. Attackers...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via 1 an SNMP OID object, 2 an SNMP trap message, 3 the View Names field, 4 the Group Names field, 5 the Flow Monitor Credentials field, 6 the Flow...