https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:54:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02891 bdu:2024-02891 https://cve.radiocsirt.org/vuln/bdu:2024-02891 https://cve.radiocsirt.org/vuln/euvd-2026-245416 EUVD-2026-245416 https://cve.radiocsirt.org/vuln/euvd-2026-245416 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23905 <p>Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.</p> <p>Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23905 https://cve.radiocsirt.org/vuln/ghsa-x22x-5pp9-8v7f <p><strong>Affected:</strong> Maven: io.jenkins.plugins:redhat-dependency-analytics</p> <p>Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.</p> <p>Red Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the &#39;Invoke Red Hat Dependency Analytics (RHDA)&#39; build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.</p> <p><strong>Affected:</strong> Maven: io.jenkins.plugins:redhat-dependency-analytics</p> <p>Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.</p> <p>Red Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the &#39;Invoke Red Hat Dependency Analytics (RHDA)&#39; build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.</p> https://cve.radiocsirt.org/vuln/ghsa-x22x-5pp9-8v7f https://cve.radiocsirt.org/vuln/gsd-2024-23905 gsd-2024-23905 https://cve.radiocsirt.org/vuln/gsd-2024-23905 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0199 <p>Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0199