CVE-2022-43434

CVE-2022-43434 affects Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier. The issue: the plugin programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, and other Jenkins download surfaces, enabling potential cross-si...

CVE-2023-49673

CVE-2023-49673 is a CSRF vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin (1.22 and earlier). Exploitation allows an attacker with basic access to trigger connections to an attacker-controlled hostname/port using attacker-supplied credentials via a crafted request. Red Hat and GitH...

CVE-2023-30517

CVE-2023-30517 affects Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier. The root cause is that the plugin unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server, exposing clients to potential inte...

CVE-2019-10430

CVE-2019-10430 affects the Jenkins NeuVector Vulnerability Scanner Plugin (versions 1.5 and earlier). The root cause is that credentials are stored unencrypted in the plugin’s global configuration file on the Jenkins master, which could be viewed by users with access to the master file system. Im...

CVE-2023-49674

CVE-2023-49674 affects Jenkins NeuVector Vulnerability Scanner Plugin ≤ 1.22. A missing permission check in a connection test HTTP endpoint (and CSRF-vulnerable behavior) lets attackers with Overall/Read connect to an attacker-specified hostname and port using attacker-specified credentials, pote...