Stored XSS vulnerability in warnings-ng

warnings-ng uses analysis results IDs to create the links to analysis results on the Jenkins UI. warnings-ng 13.10258.va17d49a78c3b and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API. This allows attackers with Item/Configure permissio...

EUVD-2022-4847

Malicious code in bioql PyPI...

EUVD-2022-5633

Malicious code in bioql PyPI...

CVE-2019-10325

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...

CVE-2019-10326

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

GHSA-PX35-882C-47HW Jenkins Warnings NG Plugin cross-site request forgery vulnerability

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

Jenkins Warnings NG Plugin Cross-site scripting vulnerability

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...

Jenkins Warnings NG Plugin cross-site request forgery vulnerability

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

GHSA-WRR5-P265-7252 Jenkins Warnings NG Plugin Cross-site scripting vulnerability

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...

XXE vulnerability in Jenkins Parasoft Findings Plugin

Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with Warnings Plugin 10.4.1 and earlier and Warnings NG Plugin 10.4.2 and newer. Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity X...

GHSA-2RH4-XGMQ-63JP XXE vulnerability in Jenkins Parasoft Findings Plugin

Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with Warnings Plugin 10.4.1 and earlier and Warnings NG Plugin 10.4.2 and newer. Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity X...

Path traversal vulnerability in warnings-ng

warnings-ng 9.10.2 and earlier does not restrict the name of a file when configuring a custom ID. This allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system. warnings-ng 9.10.3 checks for the presence of...

Missing permission checks in warnings-ng allow listing workspace contents

warnings-ng 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence ...

Stored XSS vulnerability in list view column headers

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier processed HTML embedded in list view column headers. This resulted in a stored cross-site scripting XSS vulnerability exploitable by users able to control the content of column headers. The following plugins are known to allow users to define...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

CVE-2019-10326

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

CVE-2019-10326

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds...

Cross site scripting

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...

CVE-2019-10325

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages...

CVE-2019-10325

CVE-2019-10325 affects the Jenkins Warnings NG Plugin, version 5.0.0 and earlier. The issue is described as a cross-site scripting vulnerability that allows an attacker with Job/Configure permission to inject arbitrary JavaScript into build overview pages. The underlying cause is a stored/xss-lik...