https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:46:20 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-17220 cnvd-2017-17220 https://cve.radiocsirt.org/vuln/cnvd-2017-17220 https://cve.radiocsirt.org/vuln/euvd-2026-80795 EUVD-2026-80795 https://cve.radiocsirt.org/vuln/euvd-2026-80795 https://cve.radiocsirt.org/vuln/fkie_cve-2017-1000085 <p>Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.</p> <p>Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-1000085 https://cve.radiocsirt.org/vuln/ghsa-hrwc-pqfm-g6qf <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:subversion</p> <p>Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks. As of version 2.9, this functionality properly checks permissions and is only available via POST.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:subversion</p> <p>Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks. As of version 2.9, this functionality properly checks permissions and is only available via POST.</p> https://cve.radiocsirt.org/vuln/ghsa-hrwc-pqfm-g6qf https://cve.radiocsirt.org/vuln/gsd-2017-1000085 gsd-2017-1000085 https://cve.radiocsirt.org/vuln/gsd-2017-1000085 https://cve.radiocsirt.org/vuln/rhba-2017:2642 <p>jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303) jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433) jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528) jenkins-plugin-workflow-cps: Arbitrary code execution due to incomplete sandbox protection (SECURITY-551)</p> <p>jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303) jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433) jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528) jenkins-plugin-workflow-cps: Arbitrary code execution due to incomplete sandbox protection (SECURITY-551)</p> https://cve.radiocsirt.org/vuln/rhba-2017:2642