Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

GHSA-7J3X-XM4J-JFJ7 Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...

GHSA-QXP6-27GW-99CJ Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins

Due to a time-of-check to time-of-use TOCTOU race condition, the file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2. This allows attackers with Job/Workspace...

Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins

Due to a time-of-check to time-of-use TOCTOU race condition, the file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2. This allows attackers with Job/Workspace...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2021-21611 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...

GHSA-VPJM-58CW-R8Q5 Arbitrary file read vulnerability in workspace browsers in Jenkins

The file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier. This allows attackers with Job/Workspace permission and the ability to control workspac...

com.blazemeter.plugins:blazemeterjenkinsplugin (>=2.0, <=2.6), jenkins.plugins.elanceodesk:workplace-notifier (>=1.14, <=1.16) +7 more potentially affected by CVE-2021-21602 via org.jenkins-ci.main:jenkins-core (1.576)

org.jenkins-ci.main:jenkins-core MAVEN version 1.576 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.blazemeter.plugins:blazemeterjenkinsplugin =2.0, =1.14, =1.14, =1.5, =1.6 Source cves:...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2020-2304 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2020-2304 Source...

Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller...

com.cloudbees.plugins:build-flow-plugin (0.5), org.jenkins-ci.main:jenkins-test-harness (1.463) +5 more potentially affected by CVE-2020-2161 via org.jenkins-ci.main:jenkins-core (1.463)

org.jenkins-ci.main:jenkins-core MAVEN version 1.463 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.5 - org.jenkins-ci.main:jenkins-test-harness 1.463 -...

org.jenkins-ci.plugins:artifactory (>=2.0.8, <=2.1.3), org.jenkins-ci.plugins:svn-revert-plugin (>=1.0, <=1.3) +1 more potentially affected by CVE-2020-2111 via org.jenkins-ci.plugins:subversion (1.37)

org.jenkins-ci.plugins:subversion MAVEN version 1.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:artifactory =2.0.8, =1.0, =1.0, =1.1 Source cves: CVE-2020-2111 Source...

Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file named .kube…config containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission. This temporary file is now created outside the regular project workspac...

VMware Workspace One Access Privilege Escalation

The vulnerability of the VMware Workspace One Access application management platform is related to lack of access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22973

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...

CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. Rapid7 Analysis...

Privilege escalation

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'...