CVE-2022-41237

CVE-2022-41237 affects Jenkins DotCi Plugin 2.40.00 and earlier. The vulnerability arises because the plugin’s YAML parser does not prevent the instantiation of arbitrary types, which can lead to remote code execution. This is documented across multiple sources (NVD, Red Hat advisory, OSV, and pu...

CVE-2022-41238

CVE-2022-41238 affects Jenkins DotCi Plugin, specifically versions 2.40.00 and earlier. The vulnerability is a missing permission check that allows unauthenticated attackers to trigger builds of jobs for attacker-specified repositories and commits. This is documented by multiple sources (NVD entr...

CVE-2022-41239

Summary: CVE-2022-41239 affects the Jenkins DotCi Plugin (version ≤ 2.40.00). The issue is a lack of escaping the GitHub user name parameter in commit notifications when displayed in a build cause, which leads to a stored cross-site scripting (XSS) vulnerability. Affected component: Jenkins DotCi...