com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer
10 known vulnerabilities.
10 results · Feed
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin missing permission check
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
-
High 8.0
Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
-
High 8.0
XSS vulnerability in Jenkins Build Failure Analyzer Plugin
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build…
-
Medium 4.3
Missing permission check in Jenkins Build Failure Analyzer Plugin
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
-
Medium 6.5
Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer Plugin
A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
-
High 8.8
Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin
A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.
-
Medium 6.1
Cross-site Scripting in Jenkins Build Failure Analyzer plugin
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
-
Low —
Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.