RHCOS 3 : OpenShift Container Platform 3.11 (RHSA-2019:1851)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1851 advisory. - web-console: XSS in OAuth server /oauth/token/request endpoint CVE-2019-3876 - jenkins-plugin-token-macro: XML External Entity...

RHCOS 4 : OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:1636)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1636 advisory. - jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin SECURITY-1322 CVE-2019-10320 -...

EUVD-2022-1893

Malicious code in bioql PyPI...

EUVD-2022-3903

Malicious code in bioql PyPI...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2023-27903 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

de.tsystems.mms.apm:performance-signature-viewer (>=2.5.8, <=2.5.8.1), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.2.0-beta-1) +37 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (>=2.0, <=2.7)

org.jenkins-ci.plugins:token-macro MAVEN version =2.0, =2.5.8, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =0.3.0-beta-1, =1.1.0, =3.7.0, =1.1.7, =1.7.0, =2.0.0, =2.15, =2.18 and more Source cves: CVE-2019-10337 Source advisory: GHSA-G6H2-4X64-C59X...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins:antexec (1.11) +10 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.10)

org.jenkins-ci.plugins:token-macro MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =5.0, =1.3.1, =1.0.1, =1.0, =0.1, =2.38, =1.4.1,...

GHSA-G6H2-4X64-C59X Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

An XML external entities XXE vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side...

org.jenkins-ci.plugins:email-ext (2.36), se.diabol.jenkins.pipeline:delivery-pipeline-plugin (>=0.6.1, <=0.6.7) potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.8.1)

org.jenkins-ci.plugins:token-macro MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:email-ext 2.36 - se.diabol.jenkins.pipeline:delivery-pipeline-plugin...

com.coravy.hudson.plugins.github:github (>=1.14.1, <=1.29.4), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.1.1, <=4.1.6) +17 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.11)

org.jenkins-ci.plugins:token-macro MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - com.coravy.hudson.plugins.github:github =1.14.1, =4.1.1, =0.1-preview-4, =1.5-alpha-1, =1.0,...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.1.2, <=1.7.1) +42 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.5.1)

org.jenkins-ci.plugins:token-macro MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.1.2, =0.1, =3.6.0,...

Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

An XML external entities XXE vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side...

de.tsystems.mms.apm:performance-signature-viewer (>=2.5.8, <=2.5.8.1), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.2.0-beta-1) +37 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (>=2.0, <=2.7)

org.jenkins-ci.plugins:token-macro MAVEN version =2.0, =2.5.8, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =0.3.0-beta-1, =1.1.0, =3.7.0, =1.1.7, =1.7.0, =2.0.0, =2.15, =2.18 and more Source cves: CVE-2019-10337 Source advisory: OSV:GHSA-G6H2-4X64-C59X...