CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16549
https://notcve.org/view.php?id=CVE-2019-16549
17 Dec 2019 — Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents. Jenkins Maven Release Plugin 0.16.1 y versiones anteriores no configura el analizador XML para evitar ataques de entidad externa XML (XXE), lo que permite a los atacantes de tipo "man-in-the-middle" tener Jenkins analizando documentos XML creados. • http://www.openwall.com/lists/oss-security/2019/12/17/1 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16550
https://notcve.org/view.php?id=CVE-2019-16550
17 Dec 2019 — A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents. Una vulnerabilidad de tipo cross-site request forgery en un método de formulario de prueba de conexión en Jenkins Maven Release Plugin 0.16.1 y versiones anteriores permite a los atacantes que Jenkins se conecten a un servidor web especificado por el atacante y analicen documentos X... • http://www.openwall.com/lists/oss-security/2019/12/17/1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10358
https://notcve.org/view.php?id=CVE-2019-10358
31 Jul 2019 — Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log. El Plugin Maven Integration de Jenkins versión 3.3 y anteriores, no aplicaban decoradores de registro de compilación a las compilaciones de módulos, lo que potencialmente revelaba variables de compilación confidenciales en el registro de compilación. • http://www.openwall.com/lists/oss-security/2019/07/31/1 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10327
https://notcve.org/view.php?id=CVE-2019-10327
31 May 2019 — An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks. Una vulnerabilidad de las entidades externas XML (XXE) en el Plugin Pipeline Maven Integration de Jenkins vers... • http://www.openwall.com/lists/oss-security/2019/05/31/2 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1999030
https://notcve.org/view.php?id=CVE-2018-1999030
01 Aug 2018 — An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins. Existe una vulnerabilidad de exposición de información sensible en el plugin Maven Artifact ChoiceListProvider (Nexus) en Jenkins en versiones 1.3.1 y anteriores en ArtifactoryChoiceLis... • https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1022 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000397
https://notcve.org/view.php?id=CVE-2017-1000397
26 Jan 2018 — Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. El plugin Jenkins Maven 2.73.1 y anteriores y 2.17 y anteriores incluía una versión de la biblioteca commons-httpclient con la vulnerabilidad CVE-2012-6153 que verificaba incorrectamente los certificados SSL, volviéndolo s... • https://jenkins.io/security/advisory/2017-10-11 • CWE-20: Improper Input Validation •