Most recent entries from all

cnvd-2020-53141

EUVD-2026-35917

fkie_cve-2020-2254

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.

GHSA-vq7j-6pcq-f48p — Path traversal vulnerability in Blue Ocean Plugin

Affected: Maven: io.jenkins.blueocean:blueocean

Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag, `blueocean.features.GIT_READ_SAVE_TYPE`, that when set to the value `clone` allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system.

Blue Ocean Plugin 1.23.3 no longer includes this feature and redirects existing usage to a safer alternative.

gsd-2020-2254

RHSA-2020:4297 — Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

jenkins-jira-plugin: plugin information disclosure jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests. kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API golang: data race in certain net/http servers including ReverseProxy can lead to DoS golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs