com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (1.2.0-beta-1) +13 more potentially affected by CVE-2023-25762 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=2.7)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =2.2.0, =2.0, =2.0.5, =1.0.0, =1.0.0, =1.5.0, =3.0.0-beta.2, =1.0.0, =1.0.0, =1.1.1 Source cves: CVE-2023-25762 Source advisory: GHSA-9J65-3F2Q-8Q2R...

org.jenkinsci.plugins:pipeline-model-definition (>=1.2.5, <=1.2.7) potentially affected by CVE-2023-25761 via org.jenkins-ci.plugins:junit (1.22.2)

org.jenkins-ci.plugins:junit MAVEN version 1.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - org.jenkinsci.plugins:pipeline-model-definition =1.2.5, =1.2.7 Source cves: CVE-2023-25761 Source...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (1.2.0-beta-1) +13 more potentially affected by CVE-2023-25762 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=2.7)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =2.2.0, =2.0, =2.0.5, =1.0.0, =1.0.0, =1.5.0, =3.0.0-beta.2, =1.0.0, =1.0.0, =1.1.1 Source cves: CVE-2023-25762 Source advisory: OSV:GHSA-9J65-3F2Q-8Q2R...

CVE-2023-25762

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

CVE-2023-25762

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

Cross site scripting

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

CVE-2023-25762

A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...

SUSE CVE-2016-1653

The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation, related...

SUSE CVE-2017-1000108

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

SUSE CVE-2018-14332

An issue was discovered in Clementine Music Player 1.3.1. Clementine.exe is vulnerable to a user mode write access violation due to a NULL pointer dereference in the Init call in the MoodbarPipeline::NewPadCallback function in moodbar/moodbarpipeline.cpp. The vulnerability is triggered when the...

SUSE CVE-2018-1000015

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes...

SUSE CVE-2019-15729

An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request...

SUSE CVE-2021-20180

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

SUSE CVE-2021-20178

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

Stored XSS vulnerability in pipeline-build-step

pipeline-build-step 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names. pipeline-build-step 2.18.1 escapes job names in the...

Jenkins Plugin Build Step 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site scripting...

CVE-2023-25762

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

PT-2023-20286

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Build Step Plugin versions 2.18 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because job names in a JavaScript expression used in the Pipeline Snippet Generator ar...

CVE-2023-25762: Improper Neutralization of Input During Web Page Generation

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (1.2.0-beta-1) +13 more potentially affected by CVE-2023-25762 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=2.7)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =2.2.0, =2.0, =2.0.5, =1.0.0, =1.0.0, =1.5.0, =3.0.0-beta.2, =1.0.0, =1.0.0, =1.1.1 Source cves: CVE-2023-25762 Source advisory: MEND:CVE-2023-25762...