Jenkins < 1.586 Multiple Vulnerabilities - Windows

Jenkins is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2014-9635

CVE-2014-9635 affects Jenkins before 1.586. The issue is that the application does not set the HttpOnly flag in Set-Cookie headers for session cookies when run on Tomcat 7.0.41+; this can allow remote attackers to access cookies via scripts and potentially obtain sensitive information. The cited ...