Most recent entries from all

BIT-jenkins-2022-34172

Affected: Bitnami: jenkins

In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

EUVD-2026-17769

fkie_cve-2022-34172

In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

GHSA-mhp7-3393-pfqr — Cross-site Scripting vulnerability in Jenkins

Affected: Maven: org.jenkins-ci.main:jenkins-core

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of `tooltip` parameters.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescape values of `tooltip` parameters.

gsd-2022-34172

WID-SEC-W-2022-0445 — Jenkins: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.