CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50775
https://notcve.org/view.php?id=CVE-2023-50775
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. Vulnerabilidad de cross-site request forgery (CSRF) en Jenkins Deployment Dashboard Plugin 1.0.10 y versiones anteriores permite a los atacantes copiar trabajos. • http://www.openwall.com/lists/oss-security/2023/12/13/4 https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3092 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-50774
https://notcve.org/view.php?id=CVE-2023-50774
A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system. Vulnerabilidad de cross-site request forgery (CSRF) en Jenkins HTMLResource Plugin 1.02 y versiones anteriores permite a los atacantes eliminar archivos arbitrarios en el sistema de archivos del controlador de Jenkins. • http://www.openwall.com/lists/oss-security/2023/12/13/4 https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3183 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50773
https://notcve.org/view.php?id=CVE-2023-50773
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Jenkins Dingding JSON Pusher Plugin 2.0 y versiones anteriores no enmascaran los tokens de acceso que se muestran en el formulario de configuración del trabajo, lo que aumenta la posibilidad de que los atacantes los observen y capturen. • http://www.openwall.com/lists/oss-security/2023/12/13/4 https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50772
https://notcve.org/view.php?id=CVE-2023-50772
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Jenkins Dingding JSON Pusher Plugin 2.0 y versiones anteriores almacenan tokens de acceso sin cifrar en archivos job config.xml en el controlador Jenkins, donde pueden ser vistos por usuarios con el permiso de elemento/lectura extendida o acceso al sistema de archivos del controlador Jenkins. • http://www.openwall.com/lists/oss-security/2023/12/13/4 https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50771
https://notcve.org/view.php?id=CVE-2023-50771
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks. El complemento de autenticación OpenId Connect de Jenkins 2.6 y versiones anteriores determina incorrectamente que una URL de redireccionamiento después de iniciar sesión apunta legítimamente a Jenkins, lo que permite a los atacantes realizar ataques de phishing. • http://www.openwall.com/lists/oss-security/2023/12/13/4 https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •