Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specifie…
[org.jenkins-ci.main:jenkins-core] View name validation bypass in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other …
[org.jenkins-ci.plugins:promoted-builds] CSRF vulnerability in Jenkins promoted builds Plugin
promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to …
[org.jenkins-ci.main:jenkins-core] Improper Input Validation in Jenkins
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the config.xml REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with…
[org.jvnet.hudson.plugins:jabber] Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin
Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller as part of its configuration.
These passwords can …
[org.jenkins-ci.plugins:dependency-track] Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials
OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained t…
[org.jenkins-ci.plugins:tfs] Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs
Team Foundation Server Plugin 5.157.1 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an…
[org.jenkins-ci.plugins:tfs] CSRF vulnerability in Jenkins Team Foundation Server Plugin allow capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …
[org.jenkins-ci.plugins:dependency-track] CSRF vulnerability and in Jenkins OWASP Dependency-Track Plugin allow capturing credentials
OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained t…
[io.jenkins.plugins:rest-list-parameter] Stored XSS vulnerability in Jenkins REST List Parameter Plugin
REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
REST List Paramete…