CSRF vulnerability in jenkins-multijob-plugin allows arbitrary code execution

jenkins-multijob-plugin 669.v9d96ad9c71b0 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CSRF vulnerability in gitlab-branch-source

gitlab-branch-source 684.veafa7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. gitlab-branch-source 688.v5fa356ee8520...

CSRF vulnerability in script-security

script-security 1158.v7c1b73a69a08 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver. This form...

CVE-2021-21666: Improper Neutralization of Input During Web Page Generation

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

PT-2021-14709 · Jenkins · Jenkins Kiuwan Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Kiuwan Plugin versions 1.6.0 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the Jenkins Kiuwan Plugin does not escape query parameters in an error message for a...

PT-2020-15528 · Jenkins · Jenkins Nerrvana Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nerrvana Plugin versions 1.02.06 and earlier Description: The issue allows attackers to have Jenkins parse crafted HTTP requests with XML data, using external entities for extraction of secrets from the Jenkins controller or server-si...

CVE-2020-2200

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2200

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2200

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

CVE-2020-2200: Improper Neutralization of Special Elements used in an OS Command

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master...

Sandbox Bypass via CSRF in Warnings Next Generation Plugin

Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to cross-site...