Archive
24 January 2023
Vulnerabilities first published on this day (UTC), newest first.
125 results · Feed
-
High 8.8
CSRF vulnerability in Jenkins TestQuality Updater Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
-
Medium 6.5
Missing permission checks in Jenkins Orka Plugin allow capturing credentials
Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing cr…
-
Critical 9.8
XML external entity vulnerability on agents in Jenkins MSTest Plugin
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 5.5
Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Medium 4.3
Jenkins GitHub Pull Request Builder Plugin missing permission check allows enumerating credentials IDs
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.5
Missing permission checks in Jenkins GitHub Pull Request Builder Plugin
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi…
-
Critical 9.8
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins …
-
High 8.8
Cross-site request forgery vulnerability in Jenkins BearyChat Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
-
High 8.8
Insufficient Session Expiration in Jenkins Azure AD Plugin
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
-
Medium 6.5
CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Medium 6.5
Missing permission check in Jenkins TestQuality Updater Plugin
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
-
Medium 6.5
Missing permission check in Jenkins RabbitMQ Consumer Plugin
A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
-
High 8.8
CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cre…
-
Medium 5.5
Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Critical 9.8
Session fixation vulnerability in Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
-
High 8.8
Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
-
Medium 4.3
Path traversal vulnerability in Jenkins PWauth Security Realm Plugin
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins con…
-
Medium 6.5
Passwords stored in plain text by Jenkins view-cloner Plugin
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
-
Medium 4.3
Missing permission checks in Jenkins Orka Plugin allow enumerating credentials IDs
A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.5
Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials t…
-
High 8.8
Cross-site request forgery vulnerability in Jenkins OpenID Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Critical 9.8
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 8.8CVE-2023-24422 Public exploit
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…
-
High 8.8
Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…
-
Critical 9.8
XML Entity Expansion in Jenkins TestComplete support Plugin
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
Medium 6.5
Missing permissions check in Jenkins JIRA Pipeline Steps Plugin
A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, …
-
Medium 5.7
Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
-
Medium 5.5
Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Medium 4.3
Cisco Spark Notifier Jenkins Plugin contains Missing Authorization
A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.1
Open redirect vulnerability in Jenkins OpenID Plugin
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
-
Medium 6.5
Cross-site request forgery in Jenkins Gerrit Trigger Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
-
Medium 6.1
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
-
Medium 6.1
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
-
Critical 9.8
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
-
High 8.1
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
-
Medium 5.5
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due t…
-
Medium 6.8
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to l…
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
High 7.8
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into en…