14 matches found
CVE-2026-27100
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds,...
CVE-2019-16563
Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties...
EUVD-2022-4867
Malicious code in bioql PyPI...
CVE-2023-35144: Improper Neutralization of Input During Web Page Generation
Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting XSS vulnerability...
Cross site scripting
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set build display names immediately...
Jenkins Plugin Naginator 跨站脚本漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins Plugin is a software application. A cross-site scripting...
GHSA-8PQX-3RXX-F5PM Jenkins discloses project names via fingerprints
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...
CVE-2019-16563
Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties...
CVE-2019-16563: Improper Neutralization of Input During Web Page Generation
Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties...
Stored XSS vulnerability in mission-control-view
mission-control-view 0.9.16 and earlier does not escape job display names and build names in the view it provides. This results in a stored cross-site scripting vulnerability that can be exploited by users able to change these properties. As of publication of this advisory, there is no fix...
jenkins-2-plugins: Stored XSS vulnerability in HTML Publisher Plugin
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those...
jenkins: Project name disclosure via fingerprints (SECURITY-153)
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...
CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2015-07827)
CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 or earlier, a security vulnerability exists in the Fingerprints page, which allows a remote attacker to obtain sensitive job and build name information through a direct request...
