1707 matches found
CVE-2021-21629
A cross-site request forgery CSRF vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters...
Jenkins Team Foundation Server 跨站请求伪造漏洞
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...
PT-2021-14677 · Jenkins · Jenkins Jabber (Xmpp) Notifier/Control Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Jabber XMPP notifier and control Plugin versions 1.41 and earlier Description: The issue concerns the storage of passwords in the global configuration file on the Jenkins controller. Specifically, passwords are stored unencrypted in t...
PT-2021-14678 · Jenkins · Jenkins Rest List Parameter Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins REST List Parameter Plugin versions 1.3.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability due to the failure to escape a parameter name reference in embedded JavaScript. This vulnerability...
PT-2021-14681 · Jenkins · Jenkins Team Foundation Server Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing...
CVE-2021-21626
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match...
Jenkins Role-based Authorization Strategy 权限许可和访问控制问题漏洞
Jenkins Role-based Authorization Strategy is Jenkins open source an application plugin . The plugin is used to add a new role-based mechanism to manage user rights . A privilege impropriety vulnerability exists in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier versions. An...
PT-2021-14667 · Oracle +1 · Java +1
Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 3.1 and earlier Description: The issue arises from an incorrect permission check, allowing attackers with Item/Read permission on nested items to access them even if they lack Item/Rea...
Cross site scripting
Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission...
jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables...
Cloudbees Jenkins TraceTronic ECU-TEST Plugin Information Disclosure Vulnerability
Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . An information disclosure...
CVE-2020-2324
Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2020-2323
Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions...
Cloudbees Jenkins 代码问题漏洞
Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A security vulnerability exists in...
PT-2020-15554 · Jenkins · Jenkins Plugin Installation Manager Tool +1
Name of the Vulnerable Software and Affected Versions: Jenkins Plugin Installation Manager Tool versions 2.1.3 and earlier Description: The issue is related to the Jenkins Plugin Installation Manager Tool not verifying plugin downloads, which may allow third parties to provide crafted plugin...
CVE-2020-2304
A flaw was found in the subversion Jenkins plugin. The XML parser is not properly configured to prevent XML external entity XXE attacks allowing an attacker the ability to control an agent process and have Jenkins parse a crafted changelog file that uses external entities for extraction of secret...
PT-2020-15530 · Jenkins · Jenkins Active Directory Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: The issue allows attackers to log in to Jenkins as any user by providing an empty password, depending on the configuration of the Active Directory server. This is possible...
PT-2020-15541 · Jenkins · Jenkins Aws Global Configuration Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins AWS Global Configuration Plugin versions 1.5 and earlier Description: A missing permission check in the Jenkins AWS Global Configuration Plugin allows attackers with Overall/Read permission to replace the global AWS configuration. Thi...
jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin
A flaw was found in the Matrix Authorization Strategy Plugin version 2.6.1 and prior. User names are not escaped in the permission table which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure, Job/Configure, or Overall/Administer permissions fo...