CVE-2020-2207

Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2206

The CVE-2020-2206 entry concerns Jenkins VncRecorder Plugin versions 1.25 and earlier. Affected component: the checkVncServ form validation endpoint, which does not escape a parameter value, causing a reflected XSS vulnerability. Root cause: inadequate escaping in the endpoint’s output. Practical...

CVE-2020-2206

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2205

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint, resulting in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators...

PT-2020-15419 · Jenkins · Jenkins Vncrecorder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VncRecorder Plugin versions 1.25 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the tool path in the checkVncServ form validation endpoint is not properly escaped...

Stored XSS vulnerability in vncrecorder

vncrecorder 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms. This results in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators. vncrecorder 1.35 escapes the tool path...

CVE-2020-2207: Improper Neutralization of Input During Web Page Generation

Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2205: Improper Neutralization of Input During Web Page Generation

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint, resulting in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators...

CVE-2020-2206: Improper Neutralization of Input During Web Page Generation

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

Reflected XSS vulnerability in vncrecorder

vncrecorder 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output. This results in a reflected cross-site scripting XSS vulnerability. vncrecorder 1.35 escapes the parameter value in the output...