Most recent entries from all

cnvd-2022-79938

EUVD-2026-16003

fkie_cve-2022-29049

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.

GHSA-jmxr-w2jc-qp7w — Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL

Affected: Maven: org.jenkins-ci.plugins:promoted-builds

Jenkins promoted builds Plugin provides dedicated support for defining promotions using [Job DSL Plugin](https://plugins.jenkins.io/job-dsl).

promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other `config.xml` files.

promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.

gsd-2022-29049

WID-SEC-W-2022-0265 — Jenkins: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen und Dateien zu manipulieren.