CSRF vulnerability in rebuild

rebuild 320.v5a0933ae7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to rebuild a previous build. As of publication of this advisory, there is no fix. Learn why we announce this...

com.sonyericsson.hudson.plugins.rebuild:rebuild (>=1.15, <=1.27), eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin (1.5.0) +8 more potentially affected by CVE-2019-1003049 via org.jenkins-ci.main:jenkins-core (1.481)

org.jenkins-ci.main:jenkins-core MAVEN version 1.481 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonyericsson.hudson.plugins.rebuild:rebuild =1.15, =2.4, =2.5.4 Source cves: CVE-2019-10030...

Stored XSS vulnerability in Rebuild Plugin

Rebuild Plugin did not escape parameter descriptions shown on the rebuild form page, resulting in a stored Cross-Site Scripting XSS vulnerability exploitable by users with the permission to configure jobs. Rebuild Plugin now applies the configured markup formatter to the parameter descriptions it...