CVE-2019-10403

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions...

Jenkins < 2.176.4 LTS / 2.197 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.197 or is a version of Jenkins LTS prior to 2.176.4. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in the /whoAmI/ URL due to the exposed 'Cookie' HTTP Header. An...

CVE-2019-3001

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

CVE-2019-3001

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

CVE-2019-3001

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

CVE-2019-3001

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

CVE-2019-3001

CVE-2019-3001 affects Oracle PeopleSoft Enterprise SCM eProcurement (component: eProcurement) version 9.2. The vulnerability allows an unauthenticated attacker with network access over HTTP to read data from the affected SCM eProcurement component. The CVSS v3.1 base score is 5.3 (Confidentiality...

Oracle PeopleSoft Enterprise SCM eProcurement CVE-2019-3001 Remote Security Vulnerability

Description Oracle PeopleSoft Enterprise SCM eProcurement is prone to a remote security vulnerability. These vulnerabilities can be exploited over the 'HTTP' protocol. These vulnerabilities affect the following supported versions: 9.2 Technologies Affected Oracle PeopleSoft Enterprise SCM...

CVE-2019-10403

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions...

CVE-2019-10403

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions...

Cross site scripting

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions...

CVE-2019-10403

CVE-2019-10403 affects Jenkins 2.196 and earlier, and LTS 2.176.3 and earlier. The vulnerability is a stored XSS in the tooltip for SCM tag actions caused by not escaping the SCM tag name, allowing an authenticated user who can control SCM tag names to execute arbitrary script in a victim’s brows...

CVE-2019-10403

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions...

PT-2019-11797 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.196 and earlier Jenkins LTS versions 2.176.3 and earlier Description: The issue results from the failure to escape the SCM tag name on the tooltip for SCM tag actions, leading to a stored XSS vulnerability. This can be...

Information Disclosure

jenkins-2-plugins is vulnerable to information disclosure. Missing permission checks in the Pipeline: Shared Groovy Libraries plugin enables an attacker to obtain confidential information about the contents of the SCM repositories that are referenced by global libraries...

jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries...

CVE-2019-10375

An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10375

An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master...

Design/Logic Flaw

An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10375

The CVE-2019-10375 issue affects the Jenkins File System SCM Plugin (versions 2.1 and earlier). If an attacker can configure jobs in Jenkins, they can read arbitrary files from the Jenkins master, due to an arbitrary file read vulnerability in the plugin. Remediation, where stated, is to upgrade ...