Lucene search

K
JenkinsPipeline Maven Integration

6 matches found

CVE
CVE
added 2019/05/31 3:29 p.m.215 views

CVE-2019-10327

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for ext...

8.1CVSS8AI score0.00148EPSS
CVE
CVE
added 2023/09/06 1:15 p.m.101 views

CVE-2023-41934

Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.

5.3CVSS5.2AI score0.0008EPSS
CVE
CVE
added 2020/09/16 2:15 p.m.70 views

CVE-2020-2256

Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

5.4CVSS5.2AI score0.00233EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.59 views

CVE-2020-2235

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkin...

6.5CVSS6.4AI score0.0041EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.56 views

CVE-2020-2233

A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

6.5CVSS6.3AI score0.00048EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.51 views

CVE-2020-2234

A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

6.5CVSS6.3AI score0.00048EPSS