CVE-2020-2283: Improper Neutralization of Input During Web Page Generation

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting XSS vulnerability exploitable by users able to control changeset files evaluated by the plugin...

CVE-2020-2285: Missing Authorization

A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

PT-2020-15515 · Jenkins · Jenkins Liquibase Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Liquibase Runner Plugin versions 1.4.7 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be done...

CVE-2020-2176

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

CVE-2020-2176

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

Cross site scripting

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

CVE-2020-2176

CVE-2020-2176 describes an XSS vulnerability in Jenkins with the useMango Runner Plugin 1.4 and earlier, where multiple form validation endpoints do not escape values received from the useMango service. This allows an attacker who can control returned values to execute scripts in a user’s browser...

PT-2020-15389 · Usemango +1 · Usemango Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: useMango Runner Plugin versions 1.4 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. Multiple form validation endpoints in the useMango Runner Plugin do not escape values received from the useMango...

CVE-2020-2176: Improper Neutralization of Input During Web Page Generation

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting XSS vulnerability exploitable by users able to control the values returned from the useMango service...

Command Injection

Overview karma-mojo is a plugin for Karma that provides a binary for running only a select subset of tests at a time instead of running the whole test suite. Affected versions of this package are vulnerable to Command Injection. The argument config can be controlled by users without any...

CVE-2019-10380

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

Code injection

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10380

Summary: CVE-2019-10380 affects Jenkins Simple Travis Pipeline Runner Plugin (versions 1.0 and earlier). The root cause is unsafe values in the plugin’s custom Script Security whitelist, enabling attackers able to execute Script Security protected scripts to run arbitrary code on vulnerable Jenki...

CVE-2019-10380: Undefined Security Weakness

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2018-1000146

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

Remote code execution

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

CVE-2018-1000146

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

CVE-2018-1000146

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...

CVE-2018-1000146

CVE-2018-1000146 : The vulnerability affects Liquibase Runner Plugin (Jenkins) versions 1.3.0 and older. Affected component/timeframe: plugin enables an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM. Documented impact is arbitrary code exe...

CVE-2018-1000146: Undefined Security Weakness

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM...