https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:00:11 +0000 https://cve.radiocsirt.org/vuln/bit-jenkins-2021-21602 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.</p> https://cve.radiocsirt.org/vuln/bit-jenkins-2021-21602 https://cve.radiocsirt.org/vuln/cnvd-2021-04653 cnvd-2021-04653 https://cve.radiocsirt.org/vuln/cnvd-2021-04653 https://cve.radiocsirt.org/vuln/euvd-2026-22299 EUVD-2026-22299 https://cve.radiocsirt.org/vuln/euvd-2026-22299 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21602 <p>Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.</p> <p>Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21602 https://cve.radiocsirt.org/vuln/ghsa-vpjm-58cw-r8q5 <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.</p> <p>This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.</p> <p>This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904).</p> <p>Jenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads.</p> <p>This fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.</p> <p>This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.</p> <p>This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904).</p> <p>Jenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads.</p> <p>This fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.</p> https://cve.radiocsirt.org/vuln/ghsa-vpjm-58cw-r8q5 https://cve.radiocsirt.org/vuln/gsd-2021-21602 gsd-2021-21602 https://cve.radiocsirt.org/vuln/gsd-2021-21602 https://cve.radiocsirt.org/vuln/rhsa-2021:0423 <p>ant: insecure temporary file vulnerability ant: insecure temporary file jenkins: Arbitrary file read vulnerability in workspace browsers jenkins: XSS vulnerability in notification bar jenkins: Improper handling of REST API XML deserialization errors jenkins: Path traversal vulnerability in agent names jenkins: Arbitrary file existence check in file fingerprints jenkins: Excessive memory allocation in graph URLs leads to denial of service jenkins: Stored XSS vulnerability in button labels jenkins: Missing permission check for paths with specific prefix jenkins: Reflected XSS vulnerability in markup formatter preview jenkins: Stored XSS vulnerability on new item page jenkins: Filesystem traversal by privileged users</p> <p>ant: insecure temporary file vulnerability ant: insecure temporary file jenkins: Arbitrary file read vulnerability in workspace browsers jenkins: XSS vulnerability in notification bar jenkins: Improper handling of REST API XML deserialization errors jenkins: Path traversal vulnerability in agent names jenkins: Arbitrary file existence check in file fingerprints jenkins: Excessive memory allocation in graph URLs leads to denial of service jenkins: Stored XSS vulnerability in button labels jenkins: Missing permission check for paths with specific prefix jenkins: Reflected XSS vulnerability in markup formatter preview jenkins: Stored XSS vulnerability on new item page jenkins: Filesystem traversal by privileged users</p> https://cve.radiocsirt.org/vuln/rhsa-2021:0423