CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30959
https://notcve.org/view.php?id=CVE-2022-30959
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una comprobación de permiso faltante en Jenkins SSH Plugin versiones 2.6.1 y anteriores, permite a atacantes con permiso de Overall/Read conectarse a un servidor SSH especificado por el atacante usando IDs de credenciales especificadas por el atacante obtenidas mediante otro método, capturando credenciales almacenadas en Jenkins • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30958
https://notcve.org/view.php?id=CVE-2022-30958
A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins SSH Plugin versiones 2.6.1 y anteriores, permite a atacantes conectarse a un servidor SSH especificado por el atacante usando IDs de credenciales especificados por el atacante obtenidos mediante otro método, capturando credenciales almacenadas en Jenkins • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30957
https://notcve.org/view.php?id=CVE-2022-30957
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Una comprobación de permisos ausente en el plugin SSH de Jenkins versiones 2.6.1 y anteriores, permite a atacantes con permiso Overall/Read enumerar los ID de credenciales almacenados en Jenkins • http://www.openwall.com/lists/oss-security/2022/05/17/8 https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2315 • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30956
https://notcve.org/view.php?id=CVE-2022-30956
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. El plugin Jenkins Rundeck versiones 3.6.10 y anteriores, no restringe los esquemas de URL en los envíos de webhooks de Rundeck, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado que puede ser explotada por atacantes capaces de enviar cargas útiles de webhooks de Rundeck diseñadas • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30955
https://notcve.org/view.php?id=CVE-2022-30955
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Jenkins GitLab Plugin versiones 1.5.31 y anteriores, no llevan a cabo una comprobación de permisos en un endpoint HTTP, lo que permite a atacantes con permiso Overall/Read enumerar los ID de las credenciales almacenadas en Jenkins • https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2753 • CWE-862: Missing Authorization •