Most recent entries from all

EUVD-2026-211638

fkie_cve-2023-32996

A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.

GHSA-w88f-j9rc-h7v3 — Jenkins SAML Single Sign On(SSO) Plugin missing permission checks

Affected: Maven: io.jenkins.plugins:miniorange-saml-sp

Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.

gsd-2023-32996

WID-SEC-W-2023-1228 — Jenkins Plugins: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um einen Cross-Site-Scripting-Angriff-durchzuführen, Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Request-Forgery-Angriff durchzuführen.