org.jenkins-ci.main:jenkins-test-harness (1.442), org.jenkins-ci.main:jenkins-war (1.442) +6 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:jenkins-core (1.442)

org.jenkins-ci.main:jenkins-core MAVEN version 1.442 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.442 - org.jenkins-ci.main:jenkins-war 1.442 -...

org.jvnet.hudson.main:hudson-test-harness (1.308), org.jvnet.hudson.main:hudson-war (1.308) +7 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (1.308)

org.jvnet.hudson.main:hudson-core MAVEN version 1.308 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.jvnet.hudson.main:hudson-test-harness 1.308 - org.jvnet.hudson.main:hudson-war 1.308 -...

org.jvnet.hudson.main:hudson-test-harness (1.288), org.jvnet.hudson.main:hudson-war (1.288) +3 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (1.288)

org.jvnet.hudson.main:hudson-core MAVEN version 1.288 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.jvnet.hudson.main:hudson-test-harness 1.288 - org.jvnet.hudson.main:hudson-war 1.288 -...

org.jenkins-ci.main:jenkins-test-harness (1.400), org.jenkins-ci.main:jenkins-war (1.400) +2 more potentially affected by CVE-2019-10358 via org.jenkins-ci.main:maven-plugin (1.400)

org.jenkins-ci.main:maven-plugin MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.400 - org.jenkins-ci.main:jenkins-war 1.400 -...

org.jenkins-ci.main:jenkins-test-harness (1.400), org.jenkins-ci.main:jenkins-war (1.400) +2 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (1.400)

org.jenkins-ci.main:maven-plugin MAVEN version 1.400 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.400 - org.jenkins-ci.main:jenkins-war 1.400 -...

org.jenkins-ci.main:jenkins-test-harness (1.509.2), org.jenkins-ci.main:jenkins-war (1.509.2) +3 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (1.509.2)

org.jenkins-ci.main:maven-plugin MAVEN version 1.509.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.509.2 - org.jenkins-ci.main:jenkins-war 1.509.2 -...

XXE vulnerability in m2release

m2release retrieves XML from Nexus repository manager APIs. m2release 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. While Jenkins users without Overall/Administer permission are not allowed to configure a custom Nexus URL, this could still be...

Stored XSS vulnerability in m2release

m2release did not properly escape variables in multiple views, resulting in a stored cross-site scripting vulnerability. Variables on affected views are now escaped...

m2release stored credentials in plain text

m2release stored credentials unencrypted in its global configuration file org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. m2release now stores credentials encrypte...

CSRF vulnerability in m2release

m2release did not require that requests sent to the endpoint used to initiate the release process use POST. This resulted in a cross-site request forgery vulnerability that allows attackers to perform releases. m2release now requires that these requests be sent via POST...