|
201001
|
5.4 |
MEDIUM
Network
|
jenkins
|
link_column
|
Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability.
|
CWE-79
Cross-site Scripting
|
CVE-2020-2219
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201002
|
3.3 |
LOW
Local
|
hp_application_lifecycle_management_quality_center_project
|
hp_application_lifecycle_management_quality_center
|
Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master fil…
|
CWE-522
Insufficiently Protected Credentials
|
CVE-2020-2218
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201003
|
6.1 |
MEDIUM
Network
|
praqma
|
compatibility_action_storage
|
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scr…
|
CWE-79
Cross-site Scripting
|
CVE-2020-2217
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201004
|
4.3 |
MEDIUM
Network
|
jenkins
|
zephyr_for_jira_test_management
|
A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attack…
|
CWE-862
Missing Authorization
|
CVE-2020-2216
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201005
|
4.3 |
MEDIUM
Network
|
jenkins
|
zephyr_for_jira_test_management
|
A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified …
|
CWE-352
Origin Validation Error
|
CVE-2020-2215
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201006
|
5.4 |
MEDIUM
Network
|
jenkins
|
zap_pipeline
|
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for dow…
|
CWE-79
Cross-site Scripting
|
CVE-2020-2214
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201007
|
4.3 |
MEDIUM
Network
|
jenkins
|
white_source
|
Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with…
|
CWE-522
Insufficiently Protected Credentials
|
CVE-2020-2213
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201008
|
4.3 |
MEDIUM
Network
|
jenkins
|
github_coverage_reporter
|
Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master f…
|
CWE-522
Insufficiently Protected Credentials
|
CVE-2020-2212
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201009
|
8.8 |
HIGH
Network
|
jenkins
|
kubernetes_ci
|
Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabili…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2020-2211
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
201010
|
4.3 |
MEDIUM
Network
|
jenkins
|
stash_branch_parameter
|
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
|
CWE-319
Cleartext Transmission of Sensitive Information
|
CVE-2020-2210
|
2024-11-21 14:24 |
2020-07-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
