CVSS: 6.1EPSS: 93%CPEs: 1EXPL: 3CVE-2020-2096 – Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-2096
15 Jan 2020 — Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability. Jenkins Gitlab Hook Plugin versión 1.4.2 y versiones anteriores, no escapa nombres de proyecto en el endpoint build_now, lo que resulta en una vulnerabilidad de tipo XSS reflejada. Jenkins Gitlab Hook plugin version 1.4.2 suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/155967 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000196
https://notcve.org/view.php?id=CVE-2018-1000196
05 Jun 2018 — A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured Gitlab token. Existe una vulnerabilidad de exposición de información sensible en el plugin Gitlab Hook en versiones 1.4.2 y anteriores de Jenkins en gitlab_notifier.rb y views/gitl... • https://jenkins.io/security/advisory/2018-05-09/#SECURITY-263 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •