Most recent entries from all

EUVD-2026-211662

fkie_cve-2023-32981

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

GHSA-6987-xccv-fhjp — Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

Affected: Maven: org.jenkins-ci.plugins:pipeline-utility-steps

Jenkins Pipeline Utility Steps Plugin provides the `untar` and `unzip` Pipeline steps to extract archives into job workspaces.

Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.

This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in `tar` and `zip` archives that would be placed outside the expected destination directory.

gsd-2023-32981

RHSA-2023:3610 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode maven-shared-utils: Command injection via Commandline class plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern springframework: Spring Expression DoS Vulnerability jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin

WID-SEC-W-2023-1228 — Jenkins Plugins: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen Cross-Site-Scripting-Angriff-durchzuführen, Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Request-Forgery-Angriff durchzuführen.