Most recent entries from all

EUVD-2026-240989

2026-10-15T14:41:37.423356+00:00

EUVD-2026-240989

fkie_cve-2023-50768

2026-10-15T14:41:37.423389+00:00

A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

GHSA-phjq-7xqp-2526 — Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability

2026-10-15T14:41:37.423420+00:00

Affected: Maven: org.sonatype.nexus.ci:nexus-jenkins-plugin

Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Nexus Platform Plugin 3.18.1-01 requires POST requests and Overall/Administer permission for the affected form validation methods.

gsd-2023-50768

2026-10-15T14:41:37.423450+00:00

gsd-2023-50768

WID-SEC-W-2023-3152 — Jenkins Plugins: Mehrere Schwachstellen

2026-10-15T14:41:37.423463+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen CSRF-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.