CVE-2022-29037

CVE-2022-29037 affects Jenkins CVS Plugin, versions 2.19 and earlier. Root cause: the plugin does not escape the name/description of CVS Symbolic Name parameters on parameter-views, causing stored XSS. Exploitation requires Item/Configure permission; no exploitation details or patches are provide...

CVE-2020-2324

The CVE-2020-2324 issue affects Jenkins CVS Plugin versions 2.16 and earlier. The root cause is that the plugin’s XML parser does not disable XML External Entity (XXE) processing, enabling an attacker who can control an agent process to have Jenkins parse a crafted changelog file that can exfiltr...