Jenkins < 1.586 Multiple Vulnerabilities - Windows

Jenkins is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), biz.neustar.jenkins.plugins:packer (>=1.0, <=1.4) +1186 more potentially affected by CVE-2014-9634 via org.jenkins-ci.main:jenkins-core (>=1.396, <=1.585)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =0.0.1, =1.0, =0.0.1, =0.9, =1.3, =1.0, =1.0.3, =1.0.0, =1.0, =1.0.0, =2.2.0, =1.0-beta-1, =2.1, =2.3 and more Source cves: CVE-2014-9634 Source advisory: GHSA-G7CF-WG27-QW87...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), biz.neustar.jenkins.plugins:packer (>=1.0, <=1.4) +1186 more potentially affected by CVE-2014-9634 via org.jenkins-ci.main:jenkins-core (>=1.396, <=1.585)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =0.0.1, =1.0, =0.0.1, =0.9, =1.3, =1.0, =1.0.3, =1.0.0, =1.0, =1.0.0, =2.2.0, =1.0-beta-1, =2.1, =2.3 and more Source cves: CVE-2014-9634 Source advisory: MEND:CVE-2014-9634...

CVE-2014-9634

CVE-2014-9634 affects Jenkins prior to 1.586 when run on Tomcat 7.0.41+. The issue is that session cookies are not marked Secure, enabling potential interception of HTTP session cookies by remote attackers. The vulnerability is tied to Jenkins’ handling of cookies in Tomcat, with impact described...