RHCOS 3 : OpenShift Container Platform 3.11 (RHSA-2019:1851)

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1851 advisory. - web-console: XSS in OAuth server /oauth/token/request endpoint CVE-2019-3876 - jenkins-plugin-token-macro: XML External Entity...

RHCOS 4 : OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:1636)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1636 advisory. - jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin SECURITY-1322 CVE-2019-10320 -...

EUVD-2022-3903

Malicious code in bioql PyPI...

EUVD-2022-1893

Malicious code in bioql PyPI...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2024-52550 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=0.0.14), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.1) +4 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.0.8, =2.0, =2.1.0, =18.5.1.1...

Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

An XML external entities XXE vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins:antexec (1.11) +10 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.10)

org.jenkins-ci.plugins:token-macro MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =5.0, =1.3.1, =1.0.1, =1.0, =0.1, =2.38, =1.4.1,...

com.nirima:docker-plugin (>=0.18, <=1.0.4), org.jenkins-ci.plugins:antexec (>=1.7, <=1.10) +3 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.7)

org.jenkins-ci.plugins:token-macro MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - com.nirima:docker-plugin =0.18, =1.7, =2.30.1, =1.11, =0.0.5, =0.2.0 Source cves:...

org.jenkins-ci.plugins:any-buildstep (0.1), org.jenkins-ci.plugins:conditional-buildstep (>=0.1, <=1.0) +4 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.4)

org.jenkins-ci.plugins:token-macro MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:any-buildstep 0.1 - org.jenkins-ci.plugins:conditional-buildstep =0.1,...

org.jenkins-ci.plugins:email-ext (>=2.37, <=2.37.2.2), org.jenkins-ci.plugins:nodelabelparameter (>=1.5.0-beta, <=1.5.1) +5 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.9)

org.jenkins-ci.plugins:token-macro MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:email-ext =2.37, =1.5.0-beta, =1.0.3, =2.0, =0.1-beta, =0.6.8, =1.1.1...

org.jenkins-ci.plugins:email-ext (2.36), se.diabol.jenkins.pipeline:delivery-pipeline-plugin (>=0.6.1, <=0.6.7) potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.8.1)

org.jenkins-ci.plugins:token-macro MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:email-ext 2.36 - se.diabol.jenkins.pipeline:delivery-pipeline-plugin...

org.jenkins-ci.plugins:email-ext (>=2.31, <=2.35.1), org.jenkins-ci.ruby-plugins:yammer (1.1.0) potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.8)

org.jenkins-ci.plugins:token-macro MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:email-ext =2.31, =2.35.1 - org.jenkins-ci.ruby-plugins:yammer 1.1.0...

de.tsystems.mms.apm:performance-signature-viewer (>=2.5.8, <=2.5.8.1), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.2.0-beta-1) +37 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (>=2.0, <=2.7)

org.jenkins-ci.plugins:token-macro MAVEN version =2.0, =2.5.8, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22, =0.3.0-beta-1, =1.1.0, =3.7.0, =1.1.7, =1.7.0, =2.0.0, =2.15, =2.18 and more Source cves: CVE-2019-10337 Source advisory: GHSA-G6H2-4X64-C59X...

org.jenkins-ci.plugins:build-name-setter (>=1.0, <=1.3) potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.0)

org.jenkins-ci.plugins:token-macro MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - org.jenkins-ci.plugins:build-name-setter =1.0, =1.3 Source cves: CVE-2019-10337 Source...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.3.5, <=0.3.15), io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0.0-b21) +16 more potentially affected by CVE-2019-10337 via org.jenkins-ci.plugins:token-macro (1.12.1)

org.jenkins-ci.plugins:token-macro MAVEN version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:token-macro and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.3.5, =1.0-alpha-1, =1.0.0-b13,...