com.coravy.hudson.plugins.github:github (>=1.1, <=1.8), org.jenkins-ci.main:jenkins-test-harness (1.445) +7 more potentially affected by CVE-2021-21696 via org.jenkins-ci.main:jenkins-core (1.445)

org.jenkins-ci.main:jenkins-core MAVEN version 1.445 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.1, =1.88, =1.1, =1.3 Source cves: CVE-2021-21696...

org.jenkins-ci.plugins:build-publisher (1.22), org.jenkins-ci.plugins:sonargraph-integration (1.0.2) +2 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (2.12)

org.jenkins-ci.main:maven-plugin MAVEN version 2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.plugins:build-publisher 1.22 - org.jenkins-ci.plugins:sonargraph-integration 1.0....

org.jenkins-ci.main:jenkins-test-harness (1.520), org.jenkins-ci.main:jenkins-war (1.520) +1 more potentially affected by CVE-2017-1000397 via org.jenkins-ci.main:maven-plugin (1.520)

org.jenkins-ci.main:maven-plugin MAVEN version 1.520 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:maven-plugin and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.520 - org.jenkins-ci.main:jenkins-war 1.520 -...

CSRF vulnerability and missing permission check in weblogic-deployer-plugin

weblogic-deployer-plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to send an HTTP HEAD request to a user-specified URL, or confirm the existence of any file or directory on the Jenkins controller...