PT-2024-39677 · Unknown · Kubeflow Pipeline View

Name of the Vulnerable Software and Affected Versions: Kubeflow Pipeline View affected versions not specified Description: The issue concerns a stored XSS vulnerability in the Kubeflow Pipeline View web UI. This vulnerability allows an attacker to inject malicious HTML code into the description...

Kubeflow Pipeline 安全漏洞

Kubeflow Pipeline is a machine learning pipeline for Kubeflow from Kubeflow, Inc. A security vulnerability exists in Kubeflow Pipeline that stems from the description field allowing html tags that are not properly filtered, resulting in vulnerability to stored cross-site scripting attacks...

CVE-2024-9526: Improper Neutralization of Input During Web Page Generation

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

CVE-2024-52551

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks. Mitigation Mitigation for this iss...

CVE-2024-52550

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action. Mitigation...

org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (>=1.0-alpha-1, <=1.0-alpha-2), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.0-alpha-1, <=1.0-alpha-2) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.14-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.14-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.pipeline-stage-view:parent-pom =1.0-alpha-...

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=2.3, <=2.4), org.jenkins-ci.plugins:github-organization-folder (>=1.5, <=1.6) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.14)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps-global-lib =2.3, =1.5, =1.6...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

io.jenkins.plugins:pipeline-agent-build-history (34.v570d1a_452f30), io.jenkins.plugins:pipeline-groovy-lib (>=727.ve832a_9244dfa, <=745.vdf6077913de0) +2 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3889.v937e0b_3412d3)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3889.v937e0b3412d3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history...

org.jenkinsci.plugins:pipeline-model-definition (>=1.1.5, <=1.2-beta-3), org.jenkinsci.plugins:pipeline-model-extensions (>=1.1.5, <=1.2-beta-3) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.33)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkinsci.plugins:pipeline-model-definition =1.1.5, =1.1.5,...

io.fabric8.pipeline:kubernetes-pipeline-aggregator (1.3), io.fabric8.pipeline:kubernetes-pipeline-devops-steps (1.3) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.7-alpha-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.7-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 -...

GHSA-P2QQ-C693-Q53W Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin

Jenkins Pipeline: Declarative Plugin 2.2214.vbb34b2ea9b83 and earlier does not check whether the main Jenkinsfile script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer...

io.jenkins.plugins:pipeline-agent-build-history (>=44.va_44d94c22f21, <=64.vd99f169b_5fd0) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3894.3896.vca_2c931e7935)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3894.3896.vca2c931e7935 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:pipeline-agent-build-history...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.6, <=1.27.11), io.jenkins.plugins:code-coverage-api (>=4.8.0, <=4.99.0) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3691.v28b_14c465a_b_b)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3691.v28b14c465abb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.6,...

io.jenkins.plugins:opentelemetry (3.1391.vcb_a_a_b_9779d75), org.jenkinsci.plugins:pipeline-model-definition (2.2214.vb_b_34b_2ea_9b_83) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3953.v19f11da_8d2fa)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3953.v19f11da8d2fa is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:opentelemetry 3.1391.vcbaab9779d75 -...

org.jenkins-ci.plugins:pipeline-graph-analysis (>=1.5, <=1.6) potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.37)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.37 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:pipeline-graph-analysis =1.5, =1.6 Source cves:...

org.jenkins-ci.plugins:pipeline-graph-analysis (>=1.7, <=1.9), org.jenkinsci.plugins:pipeline-model-definition (>=1.2.5, <=1.2.7) +1 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.41)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:pipeline-graph-analysis =1.7, =1.2.5, =1.2.5,...

com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2), de.taimos:pipeline-aws (>=1.0, <=1.13) +5 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.21)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.logmein:pipeline-bamboo =0.0.1, =1.0, =y, =2.2.0, =1.0, =0.6, =0.6,...

io.jenkins.plugins:opentelemetry (>=3.1419.v3b_27ca_911066, <=3.1423.v0d1a_2fcd2429), io.jenkins.plugins:pipeline-as-yaml (242.vb_90a_b_f42ca_07) +2 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (3969.vdc9d3a_efcc6a)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 3969.vdc9d3aefcc6a is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.plugins:opentelemetry =3.1419.v3b27ca911066,...

com.openshift.jenkins:openshift-pipeline (>=1.0.14, <=1.0.57), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11) +9 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.openshift.jenkins:openshift-pipeline =1.0.14, =1.3.0, =1.1.0, =1.1,...