Most recent entries from all

EUVD-2026-9109

fkie_cve-2023-40338

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controller file system.

GHSA-36hq-v2fc-rpqp — Jenkins Folders Plugin information disclosure vulnerability

Affected: Maven: org.jenkins-ci.plugins:cloudbees-folder

Jenkins Folders Plugin displays an error message when attempting to access the Scan Organization Folder Log if no logs are available.

In Folders Plugin 6.846.v23698686f0f6 and earlier, this error message includes the absolute path of a log file, exposing information about the Jenkins controller file system.

Folders Plugin 6.848.ve3b_fd7839a_81 does not display the absolute path of a log file in the error message.

gsd-2023-40338

RHSA-2024:0777 — Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jackson-databind: denial of service via cylic dependencies Jenkins: Session fixation vulnerability in OpenShift Login Plugin Jenkins: Open redirect vulnerability in OpenShift Login Plugin golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin may approve unsandboxed scripts jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

WID-SEC-W-2023-2088 — Jenkins: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.