https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 11:40:30 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-22653 cnvd-2019-22653 https://cve.radiocsirt.org/vuln/cnvd-2019-22653 https://cve.radiocsirt.org/vuln/euvd-2026-53563 EUVD-2026-53563 https://cve.radiocsirt.org/vuln/euvd-2026-53563 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10339 <p>A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.</p> <p>A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-10339 https://cve.radiocsirt.org/vuln/ghsa-xqqr-mq8x-22qx <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:jx-resources</p> <p>Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.</p> <p>Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.</p> <p>This form validation method now requires POST requests and Overall/Administer permissions.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:jx-resources</p> <p>Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.</p> <p>Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.</p> <p>This form validation method now requires POST requests and Overall/Administer permissions.</p> https://cve.radiocsirt.org/vuln/ghsa-xqqr-mq8x-22qx https://cve.radiocsirt.org/vuln/gsd-2019-10339 gsd-2019-10339 https://cve.radiocsirt.org/vuln/gsd-2019-10339