CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21610 – jenkins: Reflected XSS vulnerability in markup formatter preview
https://notcve.org/view.php?id=CVE-2021-21610
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup. Jenkins versiones 2.274 y anteriores, LTS versiones 2.263.1 y anteriores, no implementan ninguna restricción para la URL que presenta una vista previa formateada del marcado pasado como un parámetro de consulta, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) reflejada si el formateador de marcado configurado no prohíbe elementos no seguros (JavaScript) en el marcado. A flaw was found in jenkins. A cross-site scripting (XSS) vulnerability is possible due to the lack of restrictions in URL rendering in the formatted previews of markup passed as a query parameter if the configured markup formatter does not prohibit unsafe elements in the markup. The highest threat from this vulnerability is to data confidentiality and integrity. • https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2153 https://access.redhat.com/security/cve/CVE-2021-21610 https://bugzilla.redhat.com/show_bug.cgi?id=1925151 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21609 – jenkins: Missing permission check for paths with specific prefix
https://notcve.org/view.php?id=CVE-2021-21609
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission. Jenkins versiones 2.274 y anteriores, LTS versiones 2.263.1 y anteriores, no hacen coincidir correctamente unas URL pedidas con la lista de rutas siempre accesibles, permitiendo a atacantes sin permiso general y de lectura acceder a algunas URL como si tuvieran permiso general y de lectura. • https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2047 https://access.redhat.com/security/cve/CVE-2021-21609 https://bugzilla.redhat.com/show_bug.cgi?id=1925141 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21607 – jenkins: Excessive memory allocation in graph URLs leads to denial of service
https://notcve.org/view.php?id=CVE-2021-21607
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors. Jenkins versiones 2.274 y anteriores, LTS versiones 2.263.1 y anteriores, no limitan tamaños proporcionados como parámetros de consulta hacia unas URL de representación de gráficos, permitiendo a atacantes pedir URL diseñadas que usan toda la memoria disponible en Jenkins, conllevando potencialmente a unos errores de memoria insuficiente. • https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2025 https://access.redhat.com/security/cve/CVE-2021-21607 https://bugzilla.redhat.com/show_bug.cgi?id=1925156 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21608 – jenkins: Stored XSS vulnerability in button labels
https://notcve.org/view.php?id=CVE-2021-21608
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels. Jenkins versiones 2.274 y anteriores, LTS versiones 2.263.1 y anteriores, no escapan las etiquetas de los botones en la Interfaz de Usuario de Jenkins, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) explotable por unos atacantes con la habilidad de controlar unas etiquetas de unos botones. A flaw was found in jenkins. A cross-site scripting (XSS) vulnerability, due to the button labels not being properly escaped, can allow an attacker to control button labels. The highest threat from this vulnerability is to data confidentiality and integrity. • https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2035 https://access.redhat.com/security/cve/CVE-2021-21608 https://bugzilla.redhat.com/show_bug.cgi?id=1925140 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21605 – jenkins: Path traversal vulnerability in agent names
https://notcve.org/view.php?id=CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file. Jenkins versiones 2.274 y anteriores, LTS versiones 2.263.1 y anteriores, permite a usuarios con permiso Agent/Configure elegir nombres de agente que causa que Jenkins anule el archivo global "config.xml". A flaw was found in jenkins. Users with Agent/Configure permissions can choose agent names that cause an override to the global `config.xml` file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. • https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2021 https://access.redhat.com/security/cve/CVE-2021-21605 https://bugzilla.redhat.com/show_bug.cgi?id=1925143 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •