CVE-2023-37961

CVE-2023-37961 describes a CSRF flaw in Jenkins Assembla Auth Plugin

CVE-2019-10420

The CVE-2019-10420 affects the Jenkins Assembla Plugin, which stores the Assembla password unencrypted in the plugin’s global configuration file (jenkins.plugin.assembla.AssemblaProjectProperty.xml) on the Jenkins controller. This allows anyone with access to the Jenkins master/file system to vie...

CVE-2026-57303

The Jenkins Assembla Plugin versions 1.4 and earlier are vulnerable to XML External Entity (XXE) attacks because the XML parser is not configured to prevent them when processing responses from the configured Assembla server. An attacker capable of controlling the Assembla server responses can ext...

CVE-2026-57304

The Jenkins Assembla Plugin (version 1.4 and earlier) is vulnerable to a missing permission check in an HTTP endpoint used to test connections to an Assembla server. This flaw allows users with Overall/Read permissions to force the system to connect to an arbitrary URL using attacker-specified cr...

CVE-2026-57305

The Jenkins Assembla Plugin version 1.4 and earlier is vulnerable to a cross-site request forgery (CSRF) . The flaw exists because an HTTP endpoint used to test connections to an Assembla server lacks a permission check and does not require POST requests . This allows an attacker with Overall/Rea...