CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21626
https://notcve.org/view.php?id=CVE-2021-21626
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. Jenkins Warnings Next Generation Plugin versiones 8.4.4 y anteriores, no lleva a cabo una comprobación de permisos en los métodos que implementan una validación de formularios, permitiendo a atacantes con permiso Item/Read pero sin permiso Item/Workspace o Item/Configure para comprobar si los patrones de archivo especificados por el atacante coinciden con el contenido del espacio de trabajo • http://www.openwall.com/lists/oss-security/2021/03/18/5 https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2041 • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10325
https://notcve.org/view.php?id=CVE-2019-10325
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages. Una vulnerabilidad de tipo cross-site scripting en el Plugin Warnings NG de Jenkins versión 5.0.0 y anteriores, permitía al atacante con permiso de Trabajo y de Configuración inyectar JavaScript arbitrario en páginas de resumen de compilación. • http://www.openwall.com/lists/oss-security/2019/05/31/2 http://www.securityfocus.com/bid/108540 https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1003023
https://notcve.org/view.php?id=CVE-2019-1003023
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML. Existe una vulnerabilidad Cross-Site Scripting (XSS) en Jenkins Warnings Next Generation Plugin, en versiones 1.0.1 y anteriores, en src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java y src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java, que permite que los atacantes con la capacidad de controlar las entradas del analizador de advertencias hagan que Jenkins renderice HTML arbitrario. • https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-1003008
https://notcve.org/view.php?id=CVE-2019-1003008
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint. Existe una vulnerabilidad Cross-Site Request Forgery (CSRF) en Jenkins Warnings Next Generation Plugin, en versiones 2.1.1 y anteriores, en src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java, que permite que los atacantes ejecuten código arbitrario mediante un endpoint HTTP de validación de formularios. • https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20%282%29 • CWE-352: Cross-Site Request Forgery (CSRF) •