PT-2024-35370

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1367.vdf2fc45f229c and earlier, except 1365.1367.va 3b b 89f8a 95b and 1362.1364.v4cf2dc5d8776 Description The issue concerns a method implementing form validation that does not perform a permission chec...

Missing permission check in script-security

script-security 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of files on the controller file...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins 2.470 and earlier and Jenkins LTS 2.452.3 and earlier, which stems from a...

PT-2023-31643 · Jenkins · Jenkins Htmlresource Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTMLResource Plugin versions 1.02 and earlier Description: A cross-site request forgery CSRF issue allows attackers to delete arbitrary files on the Jenkins controller file system. This can be exploited by attackers to potentially...

CVE-2023-37963

A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

CVE-2023-37962

A cross-site request forgery CSRF vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified URL and to check for the existence of directories, .csv, and .ycsb files on the Jenkins controller file system...

PT-2023-25166 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction...

CVE-2022-48327

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 dataInicial, 2 dataFinal, 3 tipocliente, 4 format, 5 precoInicial, 6 precoFinal, 7 estoqueInicial, 8 estoqueFinal, 9 deid, 10 ateid, 11 clientesid, 12...

PT-2022-27483 · Jenkins +1 · Jenkins Pipeline Utility Steps Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline Utility Steps Plugin versions 2.13.1 and earlier Description: The issue allows attackers who can configure Pipelines to read arbitrary files from the Jenkins controller file system. This is due to the lack of restriction on t...

CVE-2022-43429

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system...

Jenkins Compuware Topaz for Total Test Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Agent-to-controller security bypass vulnerabilities in compuware-topaz-for-total-test

compuware-topaz-for-total-test 2.4.8 and earlier implements two agent/controller messages that do not limit where they can be executed. RemoteSystemProperties allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process...

CVE-2022-41235

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system...

CVE-2022-30313

Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety Manager multiple proprietary protocols with unauthenticated functionality issue. The affected components are...

CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service...

PT-2022-4008 · Jenkins · Jenkins Buckminster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Buckminster Plugin versions 1.1.1 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Buckminster Plugin, allowing remote attackers with Overall/Read permission to gain unauthorized...

Missing permission checks in openstack-heat allow listing the Jenkins controller file system

openstack-heat 1.5 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to...

Missing permission check in buckminster

buckminster 1.1.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to...

PT-2022-22356 · Jenkins · Jenkins Opsgenie Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpsGenie Plugin versions 1.9 and earlier Description: The issue concerns the transmission and storage of API keys in plain text. Specifically, API keys are transmitted in plain text as part of the global Jenkins configuration form and...

workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Multibranch follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step. This flaw allows attackers that can configure Pipelines, to read arbitrary files on the Jenkins...