GHSA-JRJ6-QX48-3CPQ Jenkins Favorite View Plugin cross-site request forgery vulnerability

Jenkins Favorite View Plugin 5.v77a37f62782d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to add or remove views from another user’s favorite views tab bar. As of publication of...

Jenkins Folders Plugin cross-site request forgery vulnerability

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allo...

GHSA-4VQP-PCM3-73XP Jenkins Folders Plugin cross-site request forgery vulnerability

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allo...

Cross-Site Request Forgery (CSRF)

bazaar is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists because the library does not require POST requests for an HTTP endpoint, which allows an attacker to delete previously created Bazaar SCM tags...

CSRF vulnerability in Bazaar Plugin

Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete previously created Bazaar SCM tags...

Improper Access Control

Jenkins Dimensions Plugin is vulnerable to Improper Access Control. The vulnerability exists due to a missing permission check at an http endpoint which allows an attacker to enumerate credentials IDs stored and perform unauthorized actions...

Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs

Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

GHSA-27PR-R7HM-C2RC Missing permission check in Jenkins Dimensions Plugin allows enumerating credentials IDs

Dimensions Plugin 0.9.3 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Cross Site Request Forgery (CSRF)

com.sonyericsson.hudson.plugins.rebuild: rebuilder is vulnerable to Cross Site Request Forgery CSRF. The vulnerability exists because it does not require POST requests for an HTTP endpoint which allows an attacker to rebuild a previous build...

Jenkins Test Results Aggregator Plugin vulnerable to Cross Site Request Forgery

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally,...

Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Jenkins Test Results Aggregator Plugin missing permission check

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally,...

Jenkins SAML Single Sign On(SSO) Plugin missing permission check

Jenkins SAML Single Sign OnSSO Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to download a string representation of the current security realm Java ObjecttoString, which potentially includes sensitive...

GHSA-8GC7-WHPH-RX5Q Jenkins Test Results Aggregator Plugin vulnerable to Cross Site Request Forgery

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally,...

GHSA-H656-VMRG-7RR6 Jenkins Test Results Aggregator Plugin missing permission check

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally,...

GHSA-P4WR-9WFM-F9JW Jenkins SAML Single Sign On(SSO) Plugin missing permission check

Jenkins SAML Single Sign OnSSO Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to download a string representation of the current security realm Java ObjecttoString, which potentially includes sensitive...

GHSA-M9JJ-P947-M8XV Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

GHSA-23RR-6PHQ-5P65 Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system...

Design/Logic Flaw

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system...