CVE-2019-10278: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

PT-2019-11375 · Jenkins · Jenkins Zephyr Enterprise Test Management Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zephyr Enterprise Test Management Plugin affected versions not specified Description: A missing permission check in the ZeeDescriptordoTestConnection form validation method allows attackers with Overall/Read permission to initiate a...

PT-2019-11349 · Jenkins · Jenkins Ftp Publisher Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins FTP publisher Plugin affected versions not specified Description: A missing permission check in the FTPPublisher.DescriptorImpldoLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an...

PT-2019-11376 · Jenkins · Jenkins Chef Sinatra Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Chef Sinatra Plugin affected versions not specified Description: A cross-site request forgery issue exists in the ChefBuilderConfiguration.DescriptorImpldoTestConnection form validation method, allowing attackers to initiate a...

CVE-2019-1003079: Missing Authorization

A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

PT-2019-11388 · Jenkins · Jenkins Openid Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins openid Plugin affected versions not specified Description: A cross-site request forgery issue exists in the OpenIdSsoSecurityRealm.DescriptorImpldoValidate form validation method, allowing attackers to initiate a connection to an...

CVE-2019-1003082: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfigdoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003076: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003078: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003084: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptordoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003093: Missing Authorization

A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpldoTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003092: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpldoTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

CVE-2019-10289: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server...

CVE-2019-1003091: Missing Authorization

A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpldoValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-10292: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a connection to an attacker-specified server...

CSRF vulnerability and missing permission check in gearman-plugin

A missing permission check in a form validation method in gearman-plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified server. Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability...

CVE-2019-1003047

A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

PT-2019-11337 · Jenkins · Jenkins Fortify On Demand Uploader Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Uploader Plugin versions 3.0.10 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Recommendation...

PT-2019-11336 · Jenkins · Jenkins Fortify On Demand Uploader Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify on Demand Uploader Plugin versions 3.0.10 and earlier Description: A cross-site request forgery issue allows attackers to initiate a connection to an attacker-specified server. Recommendations: For Jenkins Fortify on Demand...

CVE-2019-1003046: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server...