Jenkins

Jira

5 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2023-49653

  • EPSS 0.05%
  • Published 29.11.2023 14:15:07
  • Last modified 21.11.2024 08:33:39

Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.

8.8

CVE-2023-49673

  • EPSS 0.07%
  • Published 29.11.2023 14:15:07
  • Last modified 21.11.2024 08:33:40

A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.

5.4

CVE-2022-29041

  • EPSS 27.13%
  • Published 12.04.2022 20:15:09
  • Last modified 21.11.2024 06:58:23

Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable b...

9.9

CVE-2019-16541

  • EPSS 0.48%
  • Published 21.11.2019 15:15:14
  • Last modified 21.11.2024 04:30:47

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

8.8

CVE-2018-1000412

  • EPSS 0.1%
  • Published 09.01.2019 23:29:02
  • Last modified 21.11.2024 03:40:00

An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obta...