Most recent entries from all

BIT-jenkins-2020-2105

Affected: Bitnami: jenkins

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

EUVD-2026-35815

fkie_cve-2020-2105

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

GHSA-7xp8-7wqx-5hqx — Jenkins REST APIs vulnerable to clickjacking

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the `X-Frame-Options: deny` HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and tricking the user into performing an action which would allow for the attacker to learn the content of that REST API endpoint.

Jenkins 2.219, LTS 2.204.2 now adds the `X-Frame-Options: deny` HTTP header to REST API responses, which prevents these types of clickjacking attacks.

gsd-2020-2105

RHBA-2020:0402 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking