CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2612
https://notcve.org/view.php?id=CVE-2017-2612
15 May 2018 — In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK. En Jenkins en versiones anteriores a la 2.44 y 2.32.2, usuarios con pocos privilegios fueron capaces de omitir las credenciales de descarga JDK (SECURITY-392), lo que resulta en que las próximas builds no puedan descargar un JDK. • http://www.securityfocus.com/bid/95957 • CWE-358: Improperly Implemented Security Check for Standard CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2601
https://notcve.org/view.php?id=CVE-2017-2601
10 May 2018 — Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a Cross-Site Scripting (XSS) persistente en nombres y descripciones de parámetros (SECURITY-353). Los usuarios con el permiso para configurar jobs pudieron inyectar JavaScript en nombres y descri... • http://www.openwall.com/lists/oss-security/2022/04/12/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2606
https://notcve.org/view.php?id=CVE-2017-2606
08 May 2018 — Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a una exposición de información en la API interna que permite el acceso a los nombres de los elementos que no deberían ser visibles (... • http://www.securityfocus.com/bid/95962 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-2611
https://notcve.org/view.php?id=CVE-2017-2611
08 May 2018 — Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a una exposición de información en la API interna que ... • http://www.securityfocus.com/bid/95956 • CWE-358: Improperly Implemented Security Check for Standard CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1000169
https://notcve.org/view.php?id=CVE-2018-1000169
13 Apr 2018 — An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins. Existe una vulnerabilidad de exposición de información sensible en Jenkins 2.115 y anteriores y LTS 2.107.1 y anteriores, en CLICommand.java y ViewOptionHandler.java, que permite que atacantes no autorizados c... • https://access.redhat.com/errata/RHBA-2018:1816 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1000170
https://notcve.org/view.php?id=CVE-2018-1000170
13 Apr 2018 — A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user's browser when that other user performs some UI actions. Existe una vulnerabilidad de Cross-Site Scripting (XSS) en Jenkins 2.115 y anteriores y LTS 2.107.1 y anteriores, en confirmationList.jelly y stopButton.jelly,... • https://jenkins.io/security/advisory/2018-04-11/#SECURITY-759 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-2599
https://notcve.org/view.php?id=CVE-2017-2599
11 Apr 2018 — Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321). Jenkins, en versiones anteriores a la 2.44 y 2.32.2, es vulnerable a una comprobación de permisos insuficiente. Esto permite que usuarios con permisos para crear nuevos items (por ejemplo, jobs) para sobrescribir items existentes a los que no tienen acceso (SECURITY-321). • http://www.securityfocus.com/bid/95949 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 8%CPEs: 3EXPL: 0CVE-2018-6356
https://notcve.org/view.php?id=CVE-2018-6356
20 Feb 2018 — Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded. J... • http://www.openwall.com/lists/oss-security/2018/02/14/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1000068
https://notcve.org/view.php?id=CVE-2018-1000068
16 Feb 2018 — An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system. En el servicio KeyStore, hay una omisión de permisos que permite el acceso a recursos protegidos. Esto podría llevar a un escalado de privilegios local sin necesitar privilegios de ejecución del siste... • http://www.securityfocus.com/bid/103101 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1000067
https://notcve.org/view.php?id=CVE-2018-1000067
16 Feb 2018 — An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response. Existe una sobrelectura de búfer basado en memoria dinámica (heap) en la función Exiv2::Image::byteSwap4 de image.cpp en la versión 0.26 de Exiv2. Los atacantes remotos pueden explotar esta vulnerabilidad para revelar datos de la memoria o provocar una denegación de servicio (DoS) med... • https://jenkins.io/security/advisory/2018-02-14/#SECURITY-506 • CWE-918: Server-Side Request Forgery (SSRF) •