PT-2020-15528 · Jenkins · Jenkins Nerrvana Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nerrvana Plugin versions 1.02.06 and earlier Description: The issue allows attackers to have Jenkins parse crafted HTTP requests with XML data, using external entities for extraction of secrets from the Jenkins controller or server-si...

PT-2020-15516 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 3.0 and earlier Description: The issue arises from the improper invalidation of a permission cache when the configuration is changed, resulting in permissions being granted based on an...

PT-2020-15509 · Jenkins · Jenkins Warnings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Plugin versions 5.0.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to execute arbitrary code. This issue arises because the plugin does not require POST requests for a form...

CloudBees Jenkins Validating String Parameter Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CVE-2020-2269

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to configure views...

PT-2020-15482 · Jenkins · Jenkins Validating String Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Validating String Parameter Plugin versions 2.4 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Job/Configure permission. This occurs because the...

PT-2020-15489 · Jenkins · Jenkins Custom Job Icon Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Custom Job Icon Plugin versions 0.2 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the job descriptions in tooltips are not properly escaped. Attackers with...

PT-2020-15496 · Jenkins · Jenkins Locked Files Report Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Locked Files Report Plugin versions 1.6 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because locked files' names in tooltips are not properly escaped. This can be exploite...

CloudBees Jenkins XXE Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A XXE vulnerability exists in...

PT-2020-15470 · Jenkins · Jenkins Klocwork Analysis Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Klocwork Analysis Plugin versions 2020.2.1 and earlier Description: The issue concerns an XML external entity XXE attack. This occurs because the XML parser is not configured to prevent such attacks, allowing a user who can control th...

PT-2020-15462 · Jenkins · Jenkins Database Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins database Plugin versions 1.6 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified database server using attacker-specified credentials. The vulnerability affects...

PT-2020-15474 · Readyapi +1 · Readyapi Functional Testing Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins SoapUI Pro Functional Testing Plugin versions 1.3 and earlier ReadyAPI Functional Testing Plugin versions 1.3 and earlier Description: The issue concerns the storage of project passwords in an unencrypted manner within job config.xml...

PT-2020-15468 · Jenkins · Jenkins Valgrind Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Valgrind Plugin versions 0.28 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not properly escape content in Valgrind XML reports. This allows attacke...

Cross site scripting

Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting XSS vulnerability exploitable by users with Run/Update permission...

PT-2020-15457 · Jenkins · Jenkins Yet Another Build Visualizer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Yet Another Build Visualizer Plugin versions 1.11 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the plugin does not escape tooltip content, allowing users with...

PT-2020-15420 · Jenkins · Jenkins Vncrecorder Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins VncRecorder Plugin versions 1.25 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the checkVncServ form validation endpoint does not escape a parameter value,...

PT-2020-15427 · Jenkins · Jenkins Github Coverage Reporter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Coverage Reporter Plugin versions 1.8 and earlier Jenkins GitHub Coverage Reporter Plugin versions 1.10 and earlier Description: The issue concerns the storage of secrets in plain text in the global configuration file on the...

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin allows a hacker to obtain user credentials.

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin involves the transmission of confidential information in open text. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials...

CVE-2020-2192

A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels...

PT-2020-15409 · Jenkins · Jenkins Compact Columns Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compact Columns Plugin versions 1.11 and earlier Description: The issue results in a stored cross-site scripting vulnerability. This can be exploited by users with Job/Configure permission, as the unprocessed job description is...