CVE-2023-30520

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...

CVE-2023-30519

CVE-2023-30519 affects Jenkins Quay.io trigger Plugin 0.1 and earlier, where a missing permission check allows unauthenticated attackers to trigger builds of jobs for an attacker-specified repository via the webhook endpoint (quotayio-webhook) exposed without authentication. Connected sources con...

CVE-2023-30520

The CVE-2023-30520 entry refers to Jenkins Quay.io trigger Plugin version 0.1 and earlier, which does not constrain URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, enabling a stored XSS vulnerability when attackers submit crafted webhook payloads. The issue is doc...

CVE-2023-30519

A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

PT-2023-22748 · Jenkins · Jenkins Quay.Io Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Quay.io trigger Plugin versions 0.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin does not limit URL schemes for repository homepage URLs submitted via...

CVE-2023-30520: Improper Neutralization of Input During Web Page Generation

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...

CVE-2023-30532: Missing Authorization

A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository...

PT-2023-22761 · Jenkins · Jenkins Turboscript Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins TurboScript Plugin versions 1.3 and earlier Description: A missing permission check in the plugin allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository. Recommendations...

PT-2023-22749

Name of the Vulnerable Software and Affected Versions Jenkins Assembla merge request builder Plugin versions 1.1.13 and earlier Description A missing permission check in the Jenkins Assembla merge request builder Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to t...

CVE-2023-30521: Missing Authorization

A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...

Jenkins Plugin Quay.io trigger 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-30522: Missing Authorization

A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter...

CVE-2023-30519: Missing Authorization

A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository...

PT-2023-22746 · Jenkins · Jenkins Quay.Io Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Quay.io trigger Plugin versions 0.1 and earlier Description: A missing permission check in the Jenkins Quay.io trigger Plugin allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repositor...

Jenkins Plugin Quay.io trigger 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Stored XSS vulnerability in quayio-trigger

quayio-trigger 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads. As of publication of thi...

Lack of authentication mechanism in quayio-trigger webhook

quayio-trigger provides a webhook endpoint at /quayio-webhook/ that can be used to trigger builds of jobs configured to use a specified repository. In quayio-trigger 0.1 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of...

Lack of authentication mechanism in fogbugz webhook

fogbugz provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs. In fogbugz 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter. As of publicati...

PT-2023-9507 · Openlink +4 · Virtuoso-Opensource +4

Name of the Vulnerable Software and Affected Versions: openlink virtuoso-opensource version 7.2.9 Description: The issue in the sqlc make policy trig component of the Virtuoso-opensource platform is related to the incorrect neutralization of special elements used in SQL commands. This can allow a...