Most recent entries from all

EUVD-2026-211560

fkie_cve-2023-32977

Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

GHSA-2wvv-phhw-qvmc — Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

Affected: Maven: org.jenkins-ci.plugins.workflow:workflow-job

Jenkins Pipeline: Job Plugin 1292.v27d8cc3e2602 and earlier does not escape the display name of the build that caused an earlier build to be aborted, when "Do not allow concurrent builds" is set.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

The Jenkins security team is not aware of any plugins that allow the exploitation of this vulnerability, as the build name must be set before the build starts. Pipeline: Job Plugin 1295.v395eb_7400005 escapes the display name of the build that caused an earlier build to be aborted.

gsd-2023-32977

RHSA-2023:3610 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode maven-shared-utils: Command injection via Commandline class plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern springframework: Spring Expression DoS Vulnerability jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin

WID-SEC-W-2023-1228 — Jenkins Plugins: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen Cross-Site-Scripting-Angriff-durchzuführen, Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Request-Forgery-Angriff durchzuführen.