Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape user input in a form validation response. This results in a reflected cross-site scripting XSS vulnerability. Micro Focus Application Automation Tools Plugin 6.8 escapes user input in the affected form validation...

Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs

Jenkins Ansible Plugin 1.0 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials...

Incorrect default pattern in Jenkins Audit Trail Plugin

Jenkins Audit Trail Plugin uses regular expressions to match requested URLs whose dispatch should be logged. In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request...

CSRF vulnerability in Jenkins warnings Plugin allows remote code execution

warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary code. warnings Plugin 5.0.2 requires...

GHSA-J6P9-HM3Q-HWMJ CSRF vulnerability in MongoDB Plugin

Jenkins MongoDB Plugin 1.3 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller. Additionally, these form validation methods do no...

CSRF vulnerability in MongoDB Plugin

Jenkins MongoDB Plugin 1.3 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller. Additionally, these form validation methods do no...

XSS vulnerability in Jenkins Build Failure Analyzer Plugin

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. Build Failure Analyzer...

GHSA-HJ36-V72X-CC6J Missing permission checks in Jenkins Database Plugin

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials. Database Plugin 1.7 requires Overall/Administer permission for the affected form...

CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another...

GHSA-C2HG-2JJ6-H8VH CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another...

Stored XSS vulnerability in Jenkins VncRecorder Plugin

VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms. This results in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators. VncRecorder Plugin 1.35 escapes the tool...

GHSA-VQP8-H53H-3JFH Stored XSS vulnerability in Jenkins VncRecorder Plugin

VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms. This results in a stored cross-site scripting XSS vulnerability exploitable by Jenkins administrators. VncRecorder Plugin 1.35 escapes the tool...

GHSA-F799-HFG3-48JP Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Job/Configure permission. Sonargraph Integration Plugin 3.0.1 escapes the...

OS command injection vulnerability in Jenkins Play Framework Plugin

A form validation endpoint in Play Framework Plugin executes the play command to validate a given input file. Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by use...

XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin

Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation. This results in a reflected cross-site scripting XSS vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users...

GHSA-F82V-PG74-6686 Reflected XSS vulnerability in Jenkins AWSEB Deployment Plugin

AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output. This results in a reflected cross-site scripting XSS vulnerability. AWSEB Deployment Plugin 0.3.20 escapes the values printed as part of the affected form validation endpoints...

GHSA-5X89-75R7-8RJH XSS vulnerability in Jenkins useMango Runner Plugin

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service. This results in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service. useMango Runner Plugin...

XSS vulnerability in Jenkins useMango Runner Plugin

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service. This results in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service. useMango Runner Plugin...

Reflected XSS vulnerability in Jenkins Queue cleanup Plugin

A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability XSS. Queue cleanup Plugin 1.4 correctly escapes the query parameter...

GHSA-M7PR-M4CX-6M22 Reflected XSS vulnerability in Jenkins Queue cleanup Plugin

A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability XSS. Queue cleanup Plugin 1.4 correctly escapes the query parameter...