CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24437
https://notcve.org/view.php?id=CVE-2023-24437
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una vulnerabilidad de cross-site request forgery (CSRF) en el complemento JIRA Pipeline Steps de Jenkins en su versión 2.0.165.v8846cf59f3db y anteriores permite a los atacantes conectarse a una URL especificada por el atacante utilizando ID de credenciales especificadas por el atacante obtenidas a través de otro método, capturando las credenciales almacenadas en Jenkins. • https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2786 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29041 – Jira: Stored XSS vulnerabilities in Jenkins Jira plugin
https://notcve.org/view.php?id=CVE-2022-29041
Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. El plugin Jenkins Jira versiones 3.7 y anteriores, excepto 3.6.1, no escapa el nombre y la descripción de los parámetros Jira Issue y Jira Release Version en las visualizaciones que muestran parámetros, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado que puede ser explotada por atacantes con permiso Item/Configure A flaw was found in the Jenkins Jira plugin. The Jenkins Jira plugin does not escape the name and description of a Jira Issue and Jira Release Version parameters on views displaying parameters. This issue results in a stored Cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. • https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617 https://access.redhat.com/security/cve/CVE-2022-29041 https://bugzilla.redhat.com/show_bug.cgi?id=2074850 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21652
https://notcve.org/view.php?id=CVE-2021-21652
A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Jenkins Xray - Test Management para Jira Plugin versiones 2.4.0 y anteriores, permite a atacantes conectarse a una URL especificada por el atacante utilizando unos ID de credenciales especificadas por el atacante obtenidas por medio de otro método, capturando las credenciales almacenadas en Jenkins • https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2251%20%281%29 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21653
https://notcve.org/view.php?id=CVE-2021-21653
Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Jenkins Xray - Test Management para Jira Plugin versiones 2.4.0 y anteriores no lleva a cabo una comprobación de permisos en un endpoint HTTP, permitiendo, con el permiso Overall/Read, enumerar los ID de credenciales almacenadas en Jenkins • https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2251%20%282%29 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-2216
https://notcve.org/view.php?id=CVE-2020-2216
A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password. Una falta de comprobación de permisos en Jenkins Zephyr para JIRA Test Management Plugin versiones 1.5 y anteriores, permite a atacantes con permiso General y de Lectura conectarse a un servidor HTTP especificado por el atacante usando un nombre de usuario y contraseña especificados por el atacante • http://www.openwall.com/lists/oss-security/2020/07/02/7 https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1762 • CWE-862: Missing Authorization •