CVE-2019-16554

The CVE-2019-16554 entry affects Jenkins Build Failure Analyzer Plugin (versions 1.24.1 and earlier). A missing permission check allows an attacker with Overall/Read to trigger evaluation of a computationally expensive regular expression, enabling potential impact within Jenkins environments. Pub...

CVE-2019-16553

The CVE-2019-16553 entry concerns Jenkins Build Failure Analyzer Plugin, affected through versions 1.24.1 and earlier. The vulnerability is a cross-site request forgery (CSRF) flaw that allows an attacker to trigger Jenkins to evaluate a computationally expensive regular expression, exposing perf...

CVE-2020-2244

Summary: CVE-2020-2244 affects the Jenkins Build Failure Analyzer Plugin (version 1.27.0 and earlier). The vulnerability is an XSS due to unescaped matching text in a form validation response, which can be triggered by attackers who can supply console output for builds used to test build log indi...

CVE-2023-43502

The CVE-2023-43502 entry concerns a CSRF vulnerability in the Jenkins Build Failure Analyzer Plugin (versions 2.4.1 and earlier). The underlying issue is that the plugin did not require POST for an HTTP endpoint, allowing attackers to delete Failure Causes by crafting a request that is executed i...

CVE-2019-16555

CVE-2019-16555 affects Jenkins Build Failure Analyzer Plugin (versions 1.24.1 and earlier). The root cause is a user-supplied regular expression being processed in a non-interruptible way, enabling an attacker to have Jenkins evaluate the regex without the ability to interrupt this process. This ...

CVE-2023-43500

CVE-2023-43500 affects Jenkins Build Failure Analyzer Plugin (version ≤ 2.4.1). The vulnerability is a CSRF flaw that lets an attacker cause the plugin to connect to an attacker‑specified hostname/port using attacker‑supplied username and password. This is described across multiple sources (NVD e...

CVE-2023-43501

CVE-2023-43501 affects Jenkins Build Failure Analyzer Plugin (versions ≤ 2.4.1). A missing permission check in the plugin’s connection-test endpoint allows attackers with Overall/Read to reach an attacker-specified hostname:port using attacker-specified credentials, per initial description. Conne...

CVE-2016-4988

CVE-2016-4988 describes a Cross-site scripting (XSS) vulnerability in the Jenkins Build Failure Analyzer plugin prior to version 1.16.0. The issue arises in the plugin’s handling of an unspecified parameter, allowing remote attackers to inject arbitrary web script or HTML. The impact is limited t...

CVE-2023-43499

CVE-2023-43499 concerns Jenkins’ Build Failure Analyzer Plugin up to version 2.4.1. The affected component does not escape Failure Cause names in build logs, causing a stored XSS vulnerability exploitable by attackers able to create or update Failure Causes. Documents indicate vulnerable versions...