EUVD-2023-0539

Malicious code in bioql PyPI...

EUVD-2022-5503

Malicious code in bioql PyPI...

CVE-2023-24437

A cross-site request forgery CSRF vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2020-2166

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2021-4413

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to save field icons via a...

jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin

A flaw was found in the Jenkins Pipeline Utility Steps Plugin. This flaw allows a remote, authenticated attacker to traverse directories on the system, caused by improper archive file validation. The attacker can use a specially crafted archive file containing "dot dot" sequences /../ to create o...

CVE-2023-32981

A flaw was found in the Jenkins Pipeline Utility Steps Plugin. This flaw allows a remote, authenticated attacker to traverse directories on the system, caused by improper archive file validation. The attacker can use a specially crafted archive file containing "dot dot" sequences /../ to create o...

CVE-2023-32981

The CVE-2023-32981 entry corresponds to an arbitrary file write vulnerability in the Jenkins Pipeline Utility Steps Plugin (versions up to 2.15.2). Connected Red Hat advisories RHSA-2023-3625 and RHSA-2023-3663 explicitly list CVE-2023-32981 as a vulnerability in the Jenkins/jenkins-2-plugins sta...

GHSA-6J27-3XFW-CJ2W Missing permissions check in Jenkins JIRA Pipeline Steps Plugin

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2023-24438

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

CVE-2023-24440

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Design/Logic Flaw

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

CVE-2023-24438

The CVE-2023-24438 issue affects Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier. The root cause is a missing permission check in methods handling form validation, enabling attackers with Overall/Read to connect to an attacker-specified URL using attacker-specified c...

CVE-2023-24437

The CVE-2023-24437 entry corresponds to a CSRF vulnerability in Jenkins JIRA Pipeline Steps Plugin (versions 2.0.165.v8846cf59f3db and earlier). The issue allows an attacker to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, enabling ...

PT-2023-19600 · Jenkins · Jenkins Jira Pipeline Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier Description: The issue concerns the transmission of private keys in plain text as part of the global Jenkins configuration form, potentially leading to their...

CVE-2023-24439

CVE-2023-24439 affects Jenkins JIRA Pipeline Steps Plugin (versions up to 2.0.165.v8846cf59f3db). The vulnerability arises from storing private keys unencrypted in the plugin’s global configuration file on the Jenkins controller (org.thoughtslive.jenkins.plugins.jira.JiraStepsConfig.xml), which c...

CVE-2023-24438

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

PT-2023-19597 · Jenkins · Jenkins Jira Pipeline Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins JIRA Pipeline Steps Plugin versions 2.0.165.v8846cf59f3db and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially...

CVE-2023-24439

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...