CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

Cross site scripting

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.7.1) +1 more potentially affected by CVE-2023-28669 via org.jenkins-ci.plugins:jacoco (>=1.0.9, <=1.0.19)

org.jenkins-ci.plugins:jacoco MAVEN version =1.0.9, =1.7.2, =1.0.0, =1.7, =1.12.3 Source cves: CVE-2023-28669 Source advisory: MEND:CVE-2023-28669...

CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2023-28669

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

CVE-2023-28669

Summary: Jenkins JaCoCo Plugin versions 3.3.2 and earlier are vulnerable to stored XSS due to failure to escape class and method names in the UI. The vulnerability is exploitable by attackers who can control input files used by the ‘Record JaCoCo coverage report’ post-build action. A fix exists i...

Jenkins Plugins: JaCoCo Cross-Site Scripting Vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-28669: Improper Neutralization of Input During Web Page Generation

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action...

PT-2023-21890 · Jenkins · Jenkins Jacoco Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JaCoCo Plugin versions 3.3.2 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability. It occurs because class and method names shown on the UI are not escaped, allowing attackers who can control input fil...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.12 Multiple Vulnerabilities (CloudBees Security Advisory 2023-03-21-security-advisory)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.12. It is, therefore, affected by multiple vulnerabilities including the following: - Medium Permissions in Jenkins can be enabled and disabled. Some permissions are...

Stored XSS vulnerability in jacoco

jacoco 3.3.2 and earlier does not escape class and method names shown on the UI. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action. jacoco 3.3.2.1 escapes class and method...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2023-27899...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2023-27898...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2019-10404 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2019-10404...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21691...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21690 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21690...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21689 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21689...