CVE-2020-2316

The CVE-2020-2316 vulnerability affects Jenkins’ Static Analysis Utilities Plugin (versions 1.96 and earlier). The issue is a failure to escape the annotation message shown in tooltips, causing a stored cross-site scripting (XSS) vulnerability. Exploitation is possible by attackers who have Job/C...

CVE-2019-10307

CVE-2019-10307 affects Jenkins Static Analysis Utilities Plugin ≤ 1.95 (and related analysis-core changes). The vulnerability is a CSRF flaw in DefaultGraphConfigurationView#doSave that allows attackers with Job/Read access to change per-job graph defaults for all users. Impact is configuration c...

CVE-2017-1000102

The CVE-2017-1000102 issue concerns the CloudBees Static Analysis Utilities plugin for Jenkins. The Details view in these plugins (notably the Warnings Plugin input parsed from console output) is vulnerable to a persisted cross-site scripting (XSS) attack. Malicious input can cause arbitrary HTML...

CVE-2019-10308

CVE-2019-10308 affects Jenkins Static Analysis Utilities Plugin (versions ≤ 1.95). A missing permission check in the DefaultGraphConfigurationView.doSave form handler allowed users with Overall/Read permissions to alter the per-job default graph configuration for all users. Impact: attackers with...