Build Failure Analyzer@* Security Vulnerabilities and Issues — Build Failure Analyzer@* CVE List

Lucene search

JenkinsBuild Failure Analyzer*

9 matches found

CVE•added 2019/12/17 3:15 p.m.•59 views

CVE-2019-16554

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.

4.3CVSS4.4AI score0.00058EPSS

CVE•added 2019/12/17 3:15 p.m.•58 views

CVE-2019-16553

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

8.8CVSS8.5AI score0.0011EPSS

CVE•added 2020/09/01 2:15 p.m.•57 views

CVE-2020-2244

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

5.4CVSS5.3AI score0.00171EPSS

CVE•added 2019/12/17 3:15 p.m.•56 views

CVE-2019-16555

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.

6.5CVSS6.3AI score0.00125EPSS

CVE•added 2017/02/09 3:59 p.m.•51 views

CVE-2016-4988

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

6.1CVSS6.1AI score0.00105EPSS

CVE•added 2023/09/20 5:15 p.m.•49 views

CVE-2023-43502

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

4.3CVSS4.5AI score0.00043EPSS

CVE•added 2023/09/20 5:15 p.m.•46 views

CVE-2023-43499

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.

5.4CVSS5.2AI score0.03536EPSS

CVE•added 2023/09/20 5:15 p.m.•44 views

CVE-2023-43500

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

8.8CVSS8.7AI score0.00063EPSS

CVE•added 2023/09/20 5:15 p.m.•44 views

CVE-2023-43501

A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

6.5CVSS6.2AI score0.00036EPSS