https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 15:27:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-177844 EUVD-2026-177844 https://cve.radiocsirt.org/vuln/euvd-2026-177844 https://cve.radiocsirt.org/vuln/fkie_cve-2019-1003008 <p>A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.</p> <p>A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-1003008 https://cve.radiocsirt.org/vuln/ghsa-whf8-3h58-2w9f <p><strong>Affected:</strong> Maven: io.jenkins.plugins:warnings-ng</p> <p>Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to cross-site request forgery (CSRF). This allowed attackers to execute arbitrary code on the Jenkins controller by applying AST transforming annotations such as `@Grab` to source code elements.</p> <p>The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations. Additionally, the form validation HTTP endpoint now requires that requests be sent via POST to prevent CSRF.</p> <p><strong>Affected:</strong> Maven: io.jenkins.plugins:warnings-ng</p> <p>Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to cross-site request forgery (CSRF). This allowed attackers to execute arbitrary code on the Jenkins controller by applying AST transforming annotations such as `@Grab` to source code elements.</p> <p>The affected HTTP endpoint now applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations. Additionally, the form validation HTTP endpoint now requires that requests be sent via POST to prevent CSRF.</p> https://cve.radiocsirt.org/vuln/ghsa-whf8-3h58-2w9f https://cve.radiocsirt.org/vuln/gsd-2019-1003008 gsd-2019-1003008 https://cve.radiocsirt.org/vuln/gsd-2019-1003008