Most recent entries from all

bdu:2023-07224

EUVD-2026-185925

fkie_cve-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1.

GHSA-66hv-fhcm-7xm7 — Jenkins Warnings Plugin exposures system-scoped credentials

Affected: Maven: io.jenkins.plugins:warnings-ng

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

Warnings Plugin 10.5.1 defines the appropriate context for credentials lookup. This fix has been backported to 10.4.1.

gsd-2023-46651

WID-SEC-W-2023-2750 — Jenkins: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.