https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:27:14 +0000 https://cve.radiocsirt.org/vuln/bit-jenkins-2022-20612 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.</p> https://cve.radiocsirt.org/vuln/bit-jenkins-2022-20612 https://cve.radiocsirt.org/vuln/cnvd-2022-08036 cnvd-2022-08036 https://cve.radiocsirt.org/vuln/cnvd-2022-08036 https://cve.radiocsirt.org/vuln/euvd-2026-13202 EUVD-2026-13202 https://cve.radiocsirt.org/vuln/euvd-2026-13202 https://cve.radiocsirt.org/vuln/fkie_cve-2022-20612 <p>A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.</p> <p>A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-20612 https://cve.radiocsirt.org/vuln/ghsa-p92q-7fhh-mq35 <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.</p> <p>This vulnerability allows attackers to trigger build of job without parameters.</p> <p>Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.</p> <p>This vulnerability allows attackers to trigger build of job without parameters.</p> <p>Jenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.</p> https://cve.radiocsirt.org/vuln/ghsa-p92q-7fhh-mq35 https://cve.radiocsirt.org/vuln/gsd-2022-20612 gsd-2022-20612 https://cve.radiocsirt.org/vuln/gsd-2022-20612 https://cve.radiocsirt.org/vuln/rhsa-2022:0055 <p>CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix coreos-installer: incorrect signature verification on gzip-compressed install images jenkins-2-plugins/git: stored XSS vulnerability jenkins: FilePath#mkdirs does not check permission to create parent directories jenkins: File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories jenkins: FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link jenkins: FilePath#reading(FileVisitor) does not reject any operations allowing users to have unrestricted read access jenkins: FilePath#unzip and FilePath#untar were not subject to any access control jenkins: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path jenkins: Creating symbolic links is possible without the symlink permission jenkins: The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path jenkins: When creating temporary files, permission to create files is only checked after they’ve been created. jenkins: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions jenkins: FilePath#listFiles lists files outside directories with agent read access when following symbolic links. jenkins: Agent-to-controller access control allowed writing to sensitive directory use…</p> <p>CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix coreos-installer: incorrect signature verification on gzip-compressed install images jenkins-2-plugins/git: stored XSS vulnerability jenkins: FilePath#mkdirs does not check permission to create parent directories jenkins: File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories jenkins: FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link jenkins: FilePath#reading(FileVisitor) does not reject any operations allowing users to have unrestricted read access jenkins: FilePath#unzip and FilePath#untar were not subject to any access control jenkins: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path jenkins: Creating symbolic links is possible without the symlink permission jenkins: The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path jenkins: When creating temporary files, permission to create files is only checked after they’ve been created. jenkins: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions jenkins: FilePath#listFiles lists files outside directories with agent read access when following symbolic links. jenkins: Agent-to-controller access control allowed writing to sensitive directory use…</p> https://cve.radiocsirt.org/vuln/rhsa-2022:0055