CVE-2020-2206

The CVE-2020-2206 entry concerns Jenkins VncRecorder Plugin versions 1.25 and earlier. Affected component: the checkVncServ form validation endpoint, which does not escape a parameter value, causing a reflected XSS vulnerability. Root cause: inadequate escaping in the endpoint’s output. Practical...

CVE-2020-2207: Improper Neutralization of Input During Web Page Generation

Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

PT-2020-15419 · Jenkins · Jenkins Vncrecorder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VncRecorder Plugin versions 1.25 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the tool path in the checkVncServ form validation endpoint is not properly escaped...

CVE-2020-2206: Improper Neutralization of Input During Web Page Generation

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2205: Improper Neutralization of Input During Web Page Generation

Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint, resulting in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators...

Reflected XSS vulnerability in vncrecorder

vncrecorder 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output. This results in a reflected cross-site scripting XSS vulnerability. vncrecorder 1.35 escapes the parameter value in the output...

Stored XSS vulnerability in vncrecorder

vncrecorder 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms. This results in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators. vncrecorder 1.35 escapes the tool path...