snowdensb / job-dsl-plugin Goto Github PK
View Code? Open in Web Editor NEWThis project forked from jenkinsci/job-dsl-plugin
A Groovy DSL for Jenkins Jobs - Sweeeeet!
License: Apache License 2.0
This project forked from jenkinsci/job-dsl-plugin
A Groovy DSL for Jenkins Jobs - Sweeeeet!
License: Apache License 2.0
Spring Framework: Core
Library home page: http://www.springframework.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/2.5.6.SEC03/644a23805a7ea29903bde0ccc1cd1a8b5f0432d6/spring-core-2.5.6.SEC03.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
Publish Date: 2015-02-19
URL: CVE-2014-3578
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-3578
Release Date: 2015-02-19
Fix Resolution: 3.2.9,4.0.5
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
Publish Date: 2020-03-25
URL: CVE-2020-2161
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781
Release Date: 2020-03-25
Fix Resolution: jenkins_2.228,LTS_2.204.6
⛑️ Automatic Remediation will be attempted for this issue.
Types that extend and augment the Java Collections Framework.
Library home page: http://jakarta.apache.org/commons/collections/
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190452/commons-collections-3.2.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Publish Date: 2017-12-11
URL: CVE-2017-15708
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15708
Release Date: 2017-12-10
Fix Resolution: org.apache.synapse:Apache-Synapse:3.0.1;commons-collections:commons-collections:3.2.2
Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Nested+View+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /build.gradle
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.
Publish Date: 2021-08-31
URL: CVE-2021-21680
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470
Release Date: 2021-08-31
Fix Resolution: org.jenkins-ci.plugins:nested-view:1.21
⛑️ Automatic Remediation will be attempted for this issue.
Spring Framework: Web
Library home page: http://www.springframework.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/2.5.6.SEC03/699f171339f20126f1d09dde2dd17d6db2943fce/spring-web-2.5.6.SEC03.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
Publish Date: 2020-01-10
URL: CVE-2013-6430
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6430
Release Date: 2020-01-10
Fix Resolution: 3.1.5,3.2.2
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.
Publish Date: 2019-05-20
URL: WS-2019-0379
Base Score Metrics:
master POM
Library home page: http://ant.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.ant/ant/1.9.2/112cf195dec0bd2b7967b5711b88c880b6640d86/ant-1.9.2.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Publish Date: 2020-10-01
URL: CVE-2020-11979
Base Score Metrics:
Type: Upgrade version
Origin: https://ant.apache.org/security.html
Release Date: 2020-10-01
Fix Resolution: org.apache.ant:ant:1.10.9
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.
Publish Date: 2020-07-15
URL: CVE-2020-2220
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-07-15/
Release Date: 2020-07-15
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245
⛑️ Automatic Remediation will be attempted for this issue.
Spring Framework: Web
Library home page: http://www.springframework.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/2.5.6.SEC03/699f171339f20126f1d09dde2dd17d6db2943fce/spring-web-2.5.6.SEC03.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Publish Date: 2014-04-17
URL: CVE-2014-0054
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-0054
Release Date: 2014-04-17
Fix Resolution: org.springframework:spring-web:3.2.8.RELEASE,4.0.2.RELEASE,org.springframework:spring-oxm:4.0.2.RELEASE,3.2.8.RELEASE
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.
Publish Date: 2020-07-15
URL: CVE-2020-2222
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-07-15/
Release Date: 2020-07-15
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
Publish Date: 2021-01-13
URL: CVE-2021-21602
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Ability to provide configuration files (e.g. settings.xml for maven, XML, groovy, custom files,...) loaded through the UI which will be copied to the job workspace
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/Config+File+Provider+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Publish Date: 2019-02-06
URL: CVE-2019-1003014
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2019-01-28/
Release Date: 2019-02-06
Fix Resolution: org.jenkins-ci.plugins:config-file-provider:3.5
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml
file.
Publish Date: 2021-01-13
URL: CVE-2021-21605
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Integrates Jenkins with a vSphere server
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").
Publish Date: 2018-04-05
URL: CVE-2018-1000152
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000152
Release Date: 2018-04-05
Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud:2.17
⛑️ Automatic Remediation will be attempted for this issue.
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-server-9.4.25.v20191220.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Publish Date: 2021-06-22
URL: CVE-2021-34428
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-m6cp-vxjx-65j6
Release Date: 2021-06-22
Fix Resolution: org.eclipse.jetty:jetty-server:9.4.41.v20210516,10.0.3,11.0.3
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
Publish Date: 2021-01-13
URL: CVE-2021-21610
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Publish Date: 2021-07-13
URL: CVE-2021-35515
Base Score Metrics:
Type: Upgrade version
Origin: https://commons.apache.org/proper/commons-compress/security-reports.html
Release Date: 2021-07-13
Fix Resolution: org.apache.commons:commons-compress:1.21
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.
Publish Date: 2021-01-13
URL: CVE-2021-21611
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
Publish Date: 2020-03-25
URL: CVE-2020-2163
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1796
Release Date: 2020-03-25
Fix Resolution: jenkins_2.228,LTS_2.204.6
⛑️ Automatic Remediation will be attempted for this issue.
Integrates Jenkins with a vSphere server
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.
Publish Date: 2018-04-05
URL: CVE-2018-1000151
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000151
Release Date: 2018-04-05
Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud - 2.17
⛑️ Automatic Remediation will be attempted for this issue.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/xalan/xalan/2.6.0/5b010b70e16d540dcb737caa09da1034ea721704/xalan-2.6.0.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
Publish Date: 2014-04-15
URL: CVE-2014-0107
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0107
Release Date: 2014-04-15
Fix Resolution: 2.7.2
Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
Library home page: https://commons.apache.org/proper/commons-beanutils/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar
Dependency Hierarchy:
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190451/commons-beanutils-1.7.0.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Publish Date: 2014-04-30
URL: CVE-2014-0114
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114
Release Date: 2014-04-30
Fix Resolution: commons-beanutils:commons-beanutils:1.9.4;org.apache.struts:struts2-core:2.0.5
Spring Framework: Core
Library home page: http://www.springframework.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/2.5.6.SEC03/644a23805a7ea29903bde0ccc1cd1a8b5f0432d6/spring-core-2.5.6.SEC03.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Publish Date: 2018-03-16
URL: CVE-2018-1199
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1199
Release Date: 2018-01-29
Fix Resolution: org.springframework.security:spring-security-web:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE;org.springframework.security:spring-security-config:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE;org.springframework:spring-core:4.3.14.RELEASE,5.0.3.RELEASE
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.
Publish Date: 2020-07-15
URL: CVE-2020-2221
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-07-15/
Release Date: 2020-07-15
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245
⛑️ Automatic Remediation will be attempted for this issue.
WebJar for Bootstrap
Library home page: http://webjars.org
Path to dependency file: /job-dsl-api-viewer/build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Publish Date: 2019-01-09
URL: CVE-2018-20677
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677
Release Date: 2019-01-09
Fix Resolution: 3.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Offers matrix-based security authorization strategies (global and per-project).
Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Matrix+Authorization+Strategy+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /build.gradle
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
Publish Date: 2020-07-15
URL: CVE-2020-2226
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-07-15/
Release Date: 2020-07-22
Fix Resolution: org.jenkins-ci.plugins:matrix-auth:2.6.2
⛑️ Automatic Remediation will be attempted for this issue.
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-server-9.4.25.v20191220.jar
Dependency Hierarchy:
The Eclipse Jetty Project
Library home page: http://www.eclipse.org/jetty
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-http-9.4.25.v20191220.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml
can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Publish Date: 2021-06-09
URL: CVE-2021-28169
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-gwcr-j4wh-j3cq
Release Date: 2021-06-09
Fix Resolution: org.eclipse.jetty:jetty-runner:9.4.41.v20210516, 10.0.3, 11.0.3, org.eclipse.jetty:jetty-http:9.4.41.v20210516, 10.0.3, 11.0.3,org.eclipse.jetty:jetty-servlets:9.4.41.v20210516, 10.0.3, 11.0.3, org.eclipse.jetty:jetty-server:9.4.41.v20210516, 10.0.3, 11.0.3
Groovy: A powerful, dynamic language for the JVM
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190449/groovy-all-2.3.11.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Publish Date: 2015-08-13
URL: CVE-2015-3253
Base Score Metrics:
Type: Upgrade version
Origin: http://groovy-lang.org/security.html
Release Date: 2015-08-13
Fix Resolution (org.codehaus.groovy:groovy-all): 2.4.4
Direct dependency fix Resolution (org.codenarc:CodeNarc): 1.5
⛑️ Automatic Remediation will be attempted for this issue.
Ability to provide configuration files (e.g. settings.xml for maven, XML, groovy, custom files,...) loaded through the UI which will be copied to the job workspace
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/Config+File+Provider+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.
Publish Date: 2017-10-05
URL: CVE-2017-1000104
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000104
Release Date: 2022-10-03
Fix Resolution: org.jenkins-ci.plugins:config-file-provider:2.16.2
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
Publish Date: 2020-07-15
URL: CVE-2020-2223
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-07-15/
Release Date: 2020-07-15
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245
⛑️ Automatic Remediation will be attempted for this issue.
Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Publish Date: 2021-07-13
URL: CVE-2021-35517
Base Score Metrics:
Type: Upgrade version
Origin: https://commons.apache.org/proper/commons-compress/security-reports.html
Release Date: 2021-07-13
Fix Resolution: org.apache.commons:commons-compress:1.21
The Jenkins Plugins Parent POM Project
Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Token+Macro+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/token-macro/2.0/e7d42aefb157f1181eb2b507077caa9d294659a1/token-macro-2.0.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/token-macro/2.0/e7d42aefb157f1181eb2b507077caa9d294659a1/token-macro-2.0.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.
Publish Date: 2019-02-06
URL: CVE-2019-1003011
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102
Release Date: 2019-02-06
Fix Resolution: org.jenkins-ci.plugins:token-macro:2.6
⛑️ Automatic Remediation will be attempted for this issue.
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js
Dependency Hierarchy:
WebJar for Bootstrap
Library home page: http://webjars.org
Path to dependency file: /job-dsl-api-viewer/build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
Publish Date: 2018-07-13
URL: CVE-2018-14040
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-07-13
Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
Publish Date: 2021-01-26
URL: CVE-2021-21615
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197
Release Date: 2021-01-26
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.263.3,2.276
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.
Publish Date: 2021-01-13
URL: CVE-2021-21604
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Library home page: https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1.54/f3a86e493aadee03660779add827d0f6384d0120/script-security-1.54.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Publish Date: 2019-03-28
URL: CVE-2019-1003040
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003040
Release Date: 2019-03-28
Fix Resolution: 1.56
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.
Publish Date: 2021-01-13
URL: CVE-2021-21606
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Publish Date: 2020-03-25
URL: CVE-2020-2160
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774
Release Date: 2020-03-25
Fix Resolution: jenkins_2.228,LTS_2.204.6
⛑️ Automatic Remediation will be attempted for this issue.
Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Publish Date: 2021-07-13
URL: CVE-2021-35516
Base Score Metrics:
Type: Upgrade version
Origin: https://commons.apache.org/proper/commons-compress/security-reports.html
Release Date: 2021-07-13
Fix Resolution: org.apache.commons:commons-compress:1.21
WebJar for Bootstrap
Library home page: http://webjars.org
Path to dependency file: /job-dsl-api-viewer/build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Publish Date: 2019-01-09
URL: CVE-2018-20676
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676
Release Date: 2019-01-09
Fix Resolution: 3.4.0
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.
Publish Date: 2021-01-13
URL: CVE-2021-21609
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.
Publish Date: 2020-03-25
URL: CVE-2020-2162
Base Score Metrics:
Type: Upgrade version
Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1793
Release Date: 2020-03-25
Fix Resolution: jenkins_2.228,LTS_2.204.6
⛑️ Automatic Remediation will be attempted for this issue.
The Eclipse Jetty Project
Library home page: http://www.eclipse.org/jetty
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-io-9.4.25.v20191220.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Publish Date: 2021-04-01
URL: CVE-2021-28165
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-26vr-8j45-3r4w
Release Date: 2021-04-01
Fix Resolution: org.eclipse.jetty:jetty-io:9.4.39, org.eclipse.jetty:jetty-io:10.0.2, org.eclipse.jetty:jetty-io:11.0.2
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
Publish Date: 2021-01-13
URL: CVE-2021-21607
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-01-13/
Release Date: 2021-01-13
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
Publish Date: 2018-05-15
URL: CVE-2017-2602
Base Score Metrics:
Type: Upgrade version
Origin: https://www.securityfocus.com/bid/95952
Release Date: 2018-05-15
Fix Resolution: jenkins-2.32.2
⛑️ Automatic Remediation will be attempted for this issue.
Integrates Jenkins with a vSphere server
Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").
Publish Date: 2018-04-05
URL: CVE-2018-1000153
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000153
Release Date: 2018-04-05
Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud:2.17
⛑️ Automatic Remediation will be attempted for this issue.
This plugin allows you to store credentials in Jenkins.
Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /build.gradle
Dependency Hierarchy:
This plugin allows you to store credentials in Jenkins.
Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.4/ecbbe517f49cb0031d1d32dfd38fb5c8871d5a36/credentials-2.1.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.4/ecbbe517f49cb0031d1d32dfd38fb5c8871d5a36/credentials-2.1.4.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
Publish Date: 2019-05-21
URL: CVE-2019-10320
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10320
Release Date: 2019-05-21
Fix Resolution: org.jenkins-ci.plugins:credentials:2.1.8
⛑️ Automatic Remediation will be attempted for this issue.
JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.
Library home page: http://junit.org
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/junit/junit/4.12/2973d150c0dc1fefe998f834810d68f278ea58ec/junit-4.12.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/junit/junit/4.12/2973d150c0dc1fefe998f834810d68f278ea58ec/junit-4.12.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir
system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.
Publish Date: 2020-10-12
URL: CVE-2020-15250
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-269g-pwp5-87pp
Release Date: 2020-10-12
Fix Resolution: 4.13.1
⛑️ Automatic Remediation will be attempted for this issue.
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js
Dependency Hierarchy:
WebJar for Bootstrap
Library home page: http://webjars.org
Path to dependency file: /job-dsl-api-viewer/build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar
Dependency Hierarchy:
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js
Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
Publish Date: 2019-02-20
URL: CVE-2019-8331
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-02-20
Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1
⛑️ Automatic Remediation will be attempted for this issue.
Jenkins core code and view files to render HTML.
Library home page: https://jenkins.io/jenkins-parent/jenkins-core/
Path to dependency file: /build.gradle
Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar
Dependency Hierarchy:
Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a
Found in base branch: master
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
Publish Date: 2020-08-12
URL: CVE-2020-2229
Base Score Metrics:
Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2020-08-12/
Release Date: 2020-08-12
Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.4,2.252
⛑️ Automatic Remediation will be attempted for this issue.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.