CVE-2022-45383

CVE-2022-45383 pertains to Jenkins, specifically the Support Core Plugin (versions up to 1206.v14049fa_b_d860 and earlier). The vulnerability stems from an incorrect permission check that allows attackers holding the Support/DownloadBundle permission to download a previously created support bundl...

CVE-2022-25187

CVE-2022-25187 affects Jenkins' Support Core Plugin (version 2.79 and earlier). The issue is that the support bundle may disclose sensitive information because redaction was not applied; the vulnerability stems from incomplete redaction of certain values in the bundle. The advisory notes that Jen...

CVE-2021-21621

CVE-2021-21621 concerns Jenkins Support Core Plugin (version 2.72 and earlier). The issue arises because the plugin includes serialized user authentication data as part of the support-bundle metadata (the “About user (basic authentication details only)” section), which in some configurations can ...

CVE-2019-16539

A vulnerability in Jenkins Support Core Plugin (2.63 and earlier) stems from a missing permission check. An attacker with Overall/Read permission could delete support bundles. The issue is described across multiple databases (Red Hat, SUSE, GHSA, OSV, CNVD, NVD, etc.), consistently noting lack of...

CVE-2019-16540

CVE-2019-16540 is a path traversal vulnerability in Jenkins Support Core Plugin (version 2.63 and earlier) that allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master. Affected products include Jenkins/CloudBees Jenkins with the vulnerable Support Core Plugi...