Most recent entries from all

EUVD-2026-193912

fkie_cve-2023-40337

A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

GHSA-22c3-whjv-hrfm — Jenkins Folders Plugin cross-site request forgery vulnerability

Affected: Maven: org.jenkins-ci.plugins:cloudbees-folder

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to copy a view inside a folder.

Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.

gsd-2023-40337

RHSA-2024:0777 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jackson-databind: denial of service via cylic dependencies Jenkins: Session fixation vulnerability in OpenShift Login Plugin Jenkins: Open redirect vulnerability in OpenShift Login Plugin golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin may approve unsandboxed scripts jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

WID-SEC-W-2023-2088 — Jenkins: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.