CVE-2019-10337

CVE-2019-10337 concerns an XML External Entity (XXE) vulnerability in the Jenkins Token Macro Plugin (versions 2.7 and earlier). The root cause is XXE processing when the ${XML} macro processes input, allowing an attacker who can influence the input file to trigger external entity resolution. Doc...

CVE-2019-1003011

CVE-2019-1003011 affects Jenkins Token Macro Plugin 2.5 and earlier. Affected code paths in Parser.java, TokenMacro.java, AbstractChangesSinceMacro.java, ChangesSinceLastBuildMacro.java, and ProjectUrlMacro allow an attacker who can influence token macro input (e.g., SCM changelogs) to craft recu...