zaproxy

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...

jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d

مكتبات خطوط الأنابيب المشتركة عندما يكون لديك العديد من وظائف خطوط الأنابيب، فغالبًا ما ترغب في مشاركة بعض أجزاء نصوص خطوط الأنابيب بينها للحفاظ على نصوص خطوط الأنابيب DRY. حالة استخدام شائعة جدًا هي أن لديك العديد من المشاريع التي يتم بناؤها بطريقة مماثلة. يضيف هذا المكون الإضافي هذه الوظيفة من...

jenkinsci__workflow-multibranch-plugin_CVE-2022-25175_706-vd43c65dec013

Pipeline: Multibranch परिचय Pipeline प्लगइन को बेहतर बनाता है ताकि विभिन्न ब्रांचों से बिल्ड को स्वचालित रूप से समूहित करके ब्रांचों को बेहतर ढंग से संभाला जा सके। स्वचालित रूप से एक नया Jenkins जॉब बनाता है जब भी कोई नई ब्रांच पुश की जाती है सोर्स कोड रिपॉजिटरी में। अन्य प्लगइन विभिन्न ब्रांच...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Vulnerabilità di input non convalidato nel plugin Jenkins Git Parameter. Riepilogo Questa vulnerabilità nasce perché l'input controllato dall'utente nei parametri di build di Jenkins viene iniettato in modo non sicuro nel comando Git checkout. L'input dell'utente viene fornito com...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70438

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70442

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

CVE-2026-70442

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70441

Summary: CVE-2026-70441 affects Jenkins’ Summary Display Plugin v1.15 and earlier. The root cause is failure to escape the job name in a JavaScript context on build report pages, enabling a stored XSS vulnerability. Impact/conditions: exploit requires Item/Create or Item/Configure permissions; th...

CVE-2026-70439

Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...

CVE-2026-70438

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70435

CVE-2026-70435 : A missing permission check in Jenkins SCM-Manager Plugin (1.11.1 and earlier) allows a user with Overall/Read permission to trigger outbound connections to an attacker-specified URL using attacker-specified credentials IDs, potentially exfiltrating credentials stored in Jenkins. ...

CVE-2026-70436

CVE-2026-70436 affects the Jenkins External Workspace Manager Plugin. Affected versions (1.4.1 and earlier) fail in access control when exposing externally-managed workspaces through the workspace browser: 1.4.0 and earlier perform no permission check, while 1.4.1 performs an improper permission ...

Missing permission checks in xml-job-to-job-dsl

xml-job-to-job-dsl 0.1.13 and earlier does not perform permission checks, and makes its functionality available to users lacking Overall/Read permission. While only jobs the user has Item/Read permission for will be accessible, it does not require Item/Extended Read permission to convert their...