Improper input validation allows unintended access to plugin resource files on case-insensitive file systems

Jenkins did not take into account case-insensitive file systems when preventing access to plugin resource files that should not be accessible. This allowed users with Overall/Read permission to download plugin resource files in META-INF and WEB-INF directories, such as the plugins' JAR files, whi...

SECURITY-660

Bulletin has no description...

SECURITY-699

Bulletin has no description...

SECURITY-698

Bulletin has no description...

SECURITY-521

Bulletin has no description...

SECURITY-659

Bulletin has no description...

SECURITY-655

Bulletin has no description...

SECURITY-656

Bulletin has no description...

SECURITY-658

Bulletin has no description...

SECURITY-695

Bulletin has no description...

SECURITY-694

Bulletin has no description...

SECURITY-675

Bulletin has no description...

SECURITY-507

Bulletin has no description...

SECURITY-607

Bulletin has no description...

SECURITY-657

Bulletin has no description...

Unsafe use of user names as directory names

Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of...

Persisted XSS vulnerability in autocompletion suggestions

Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters. Known previously unsafe sources for thes...