https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:46:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-02017 bdu:2023-02017 https://cve.radiocsirt.org/vuln/bdu:2023-02017 https://cve.radiocsirt.org/vuln/bit-jenkins-2023-27898 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> https://cve.radiocsirt.org/vuln/bit-jenkins-2023-27898 https://cve.radiocsirt.org/vuln/euvd-2026-219961 EUVD-2026-219961 https://cve.radiocsirt.org/vuln/euvd-2026-219961 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27898 <p>Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> <p>Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-27898 https://cve.radiocsirt.org/vuln/ghsa-j664-qhh4-hpf8 <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.</p> https://cve.radiocsirt.org/vuln/ghsa-j664-qhh4-hpf8 https://cve.radiocsirt.org/vuln/gsd-2023-27898 gsd-2023-27898 https://cve.radiocsirt.org/vuln/gsd-2023-27898 https://cve.radiocsirt.org/vuln/rhsa-2023:1655 <p>kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin haproxy: request smuggling attack in HTTP/1 header parsing Jenkins: XSS vulnerability in plugin manager Jenkins: Temporary plugin file created with insecure permissions Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents</p> <p>kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin haproxy: request smuggling attack in HTTP/1 header parsing Jenkins: XSS vulnerability in plugin manager Jenkins: Temporary plugin file created with insecure permissions Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents</p> https://cve.radiocsirt.org/vuln/rhsa-2023:1655 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0609 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Code auszuführen</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Code auszuführen</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0609