EUVD-2022-7095

Malicious code in bioql PyPI...

EUVD-2022-5891

Malicious code in bioql PyPI...

EUVD-2022-4246

Malicious code in bioql PyPI...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

SUSE CVE-2017-1000108

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability...

jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability...

Authorization Bypass

Jenkins Pipeline: Input Step Plugin is vulnerable to Authorization Bypass. The vulnerability exists because specified ID of the input step are not properly sanitized and the URLs that use the ids to process interactions are no encoded properly which allows an attacker to bypass the CSRF protectio...

net.praqma:memory-map (>=2.2.0, <=2.2.1), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.3, <=2.4) +2 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.1)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - net.praqma:memory-map =2.2.0, =2.3, =2.0.5, =1.0.0, =1.0.1 Source cves:...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-4, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-4, <=1.2.0-beta-1) +3 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.7)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4,...

io.jenkins.blueocean:blueocean (>=1.1.6, <=1.1.7), io.jenkins.blueocean:blueocean-events (>=1.1.6, <=1.1.7) +6 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.8)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.6, =1.1.6, =1.1.6, =1.1.6, =2.0.0, =1.7,...

CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin

Pipeline: Input Step Plugin 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to...

GHSA-G66M-FQXF-3W35 CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin

Pipeline: Input Step Plugin 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b24, <=1.1.0-beta-2) +16 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.5)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - com.testinium.jenkins:testinium 1.0 - io.jenkins.blueocean:blueocean...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.12)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves:...

Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin

Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build...

com.splunk.splunkins:splunk-devops-extend (>=1.0, <=1.7.0), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +14 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.0)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - com.splunk.splunkins:splunk-devops-extend =1.0, =y, =1.0.0-b10, =1.0.0-b10,...

GHSA-64R9-X74Q-WXMH Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin

Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build...