56 matches found
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters...
CSRF vulnerability in build-with-parameters
build-with-parameters 1.5 and earlier does not require POST requests for its form submission endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to build a project with attacker-specified parameters. build-with-parameters 1.5.1 requires POST...
Stored XSS vulnerability in extra-columns
extra-columns 1.22 and earlier does not escape parameter values in the build parameters column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build...
CVE-2021-21618
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Jenkins Repository Connector 跨站脚本漏洞
Jenkins Repository Connector is a Jenkins open source application plugin . Provides a repository from Nexus or Artifactory or the like to retrieve artifacts or deploy artifacts from it , as well as the realization of the repository layout of the static server . A cross-site script execution...
CVE-2021-25776
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters...
CVE-2021-25776
CVE-2021-25776 affects JetBrains TeamCity prior to 2020.2, where an ECR token could be exposed via a build parameter (information disclosure). Red Hat and CNVD entries corroborate the same issue. The JetBrains Security Bulletin Q4 2020 notes the issue under TeamCity/ECR exposure and indicates a f...
CVE-2020-2289
Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
jenkins: Content-Security-Policy headers for files uploaded leads to XSS
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability...
GeniXCMS Cross-Site Scripting Vulnerability (CNVD-2017-00738)
MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF that provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in GeniXCMS. A remote attacker can inject arbitrary web script or HTML code via build...
jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
CVE-2016-3721
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
CVE-2016-3721
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...
