CVE-2023-41944

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

PT-2023-28182

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description The issue is related to an HTML injection vulnerability. It occurs when the queue name parameter passed to a form validation URL is not escaped, resulting in the...

CVE-2023-41944: Improper Neutralization of Input During Web Page Generation

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

CSRF vulnerability and missing permission checks in Dimensions Plugin

Users with Overall/Read permission were able to access Dimensions Plugin's form validation URL, having it connect to an attacker-specified Dimensions system with attacker-specified credentials. Additionally, this form validation URL did not require POST requests, resulting in a CSRF vulnerability...