org.jenkins-ci.plugins.workflow:workflow-aggregator (1.5), org.jvnet.hudson.plugins:analysis-test (>=1.18, <=1.19) potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.5)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

com.testinium.jenkins:testinium (1.0), org.jenkins-ci.plugins.workflow:workflow-aggregator (2.5) +9 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.5)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.testinium.jenkins:testinium 1.0 -...

io.jenkins.blueocean:blueocean (>=1.0.0-b15, <=1.0.0-b21), io.jenkins.blueocean:blueocean-github-pipeline (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.3)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b15,...

Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38900

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a information disclosure attack, potentially revealing sensitive information to an administrator. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Process Manager 8.5 and 8.6 and IBM...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25183 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25182 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25181 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25181 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25180 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25180 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25178 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25178 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25177 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25177 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25176 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25176 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25174 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25174 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25173 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25173 Source advisory:...

com.testinium.jenkins:testinium (1.0), io.fabric8.jenkins.plugins:openshift-sync (>=0.9.1, <=1.0.45) +35 more potentially affected by CVE-2022-25179 via org.jenkins-ci.plugins.workflow:workflow-multibranch (>=1.13, <=2.20)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version =1.13, =0.9.1, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-1, =1.1.0-beta-4, =1.0-alpha-1, =2.2.0, =2.0, =2.0, =2.6 and more Source cves: CVE-2022-25179 Source advisor...

io.jenkins.plugins:synopsys-sigma (>=2021.12.0, <=2022.1.0) potentially affected by CVE-2022-25179 via org.jenkins-ci.plugins.workflow:workflow-multibranch (2.24)

org.jenkins-ci.plugins.workflow:workflow-multibranch MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-multibranch and may be impacted: - io.jenkins.plugins:synopsys-sigma =2021.12.0, =2022.1.0...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted...

Sensitive information disclosure in workflow-cps

workflow-cps 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. workflow-cps 2656.vf7ae7b75a457 does not allow...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrar...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...

CVE-2021-43929

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in work flow management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...