Most recent entries from all

cnvd-2020-61924

EUVD-2026-35989

fkie_cve-2020-2307

Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

GHSA-fh5w-p2j4-4p8x — Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

Affected: Maven: org.csanchez.jenkins.plugins:kubernetes

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.

This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.

gsd-2020-2307

RHSA-2021:0034 — Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update

jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials IDs python-urllib3: CRLF injection via HTTP request method