https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:38:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-22390 EUVD-2026-22390 https://cve.radiocsirt.org/vuln/euvd-2026-22390 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21679 <p>Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.</p> <p>Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21679 https://cve.radiocsirt.org/vuln/ghsa-x77r-7m5w-pqq2 <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:azure-ad</p> <p>An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. Jenkins Azure AD Plugin implements this extension point for URLs used by a JavaScript component.</p> <p>In Jenkins Azure AD Plugin 179.vf6841393099e and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL.</p> <p>This vulnerability was originally introduced in Azure AD Plugin 164.v5b48baa961d2.</p> <p>Azure AD Plugin 180.v8b1e80e6f242 no longer allows bypassing CSRF protection for URLs used by the JavaScript component. Instead, that component was reconfigured to pass the expected CSRF token.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:azure-ad</p> <p>An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. Jenkins Azure AD Plugin implements this extension point for URLs used by a JavaScript component.</p> <p>In Jenkins Azure AD Plugin 179.vf6841393099e and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL.</p> <p>This vulnerability was originally introduced in Azure AD Plugin 164.v5b48baa961d2.</p> <p>Azure AD Plugin 180.v8b1e80e6f242 no longer allows bypassing CSRF protection for URLs used by the JavaScript component. Instead, that component was reconfigured to pass the expected CSRF token.</p> https://cve.radiocsirt.org/vuln/ghsa-x77r-7m5w-pqq2 https://cve.radiocsirt.org/vuln/gsd-2021-21679 gsd-2021-21679 https://cve.radiocsirt.org/vuln/gsd-2021-21679