CloudBees Jenkins Monitoring Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Monitoring Plugin is used in one of th...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting. The vulnerability exists through the Monitoring plugin...

CVE-2019-1003022

A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master...

Denial of service

A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master...

CVE-2019-1003022

CVE-2019-1003022 concerns a denial-of-service in the Jenkins Monitoring Plugin prior to versions newer than 1.74.0, specifically in the PluginImpl.java code, which enables an attacker to kill threads running on the Jenkins master. The available connected documents consistently describe this vulne...

CVE-2019-1003022

A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master...

PT-2019-11320 · Jenkins · Jenkins Monitoring Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Monitoring Plugin versions 1.74.0 and earlier Description: A denial of service issue exists that allows attackers to kill threads running on the Jenkins master. This is due to a vulnerability in the PluginImpl.java file...

CVE-2019-1003022: Cross-Site Request Forgery (CSRF)

A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master...

Monitoring Plugin did not apply CSRF protection even if enabled in Jenkins

Monitoring Plugin provides a standalone JavaMelody servlet with an independent CSRF protection configuration. Even if Jenkins had CSRF protection enabled, Monitoring Plugin may not have it enabled. Monitoring Plugin now checks on startup whether Jenkins has CSRF protection enabled and enables its...

XML External Entity Processing Vulnerability in Monitoring Plugin

The JavaMelody library bundled in Monitoring Plugin is affected by an XML External Entity XXE processing vulnerability. This allows attacker to send crafted requests to a web application for extraction of secrets from the file system, server-side request forgery, or denial-of-service attacks...

CVE-2014-3679

The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages...

Information disclosure

The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages...

CVE-2014-3679

The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages...

CVE-2014-3679

CVE-2014-3679 affects the Jenkins Monitoring plugin prior to 1.53.0. The issue is an information-disclosure flaw where certain Monitoring plugin pages are accessible to remote attackers, allowing them to obtain sensitive information. Affected: Jenkins Monitoring plugin (pre-1.53.0). Root cause: p...

jenkins: cross-site scripting flaws in the monitoring plug-in (SECURITY-113)

Cross-site scripting XSS vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3678

Cross-site scripting XSS vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3678

Cross-site scripting XSS vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3678

CVE-2014-3678 is a Cross-site Scripting (XSS) vulnerability in the Jenkins Monitoring plugin, affecting versions before 1.53.0. The root cause is a faulty input validation in the Monitoring plugin that allows an attacker to inject arbitrary web script or HTML, via unspecified vectors, potentially...

PT-2014-5447 · Jenkins · Jenkins Monitoring Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Monitoring plugin versions prior to 1.53.0 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations: For versions prior to 1.53.0, update to version 1.53.0 or later ...