Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10355 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.427Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://access.redhat.com/errata/RHSA-2019:2651 - https://access.redhat.com/errata/RHSA-2019:2594 - https://access.redhat.com/errata/RHSA-2019:2662 - https://jenkins.io/security/advisory/2019-07-31/#SEC
/RHSA-2019:2594 - https://access.redhat.com/errata/RHSA-2019:2662 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%281%29
CVE ID: CVE-2019-10356 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.522Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://access.redhat.com/errata/RHSA-2019:2651 - https://access.redhat.com/errata/RHSA-2019:2594 - https://access.redhat.com/errata/RHSA-2019:2662 - https://jenkins.io/security/advisory
edhat.com/errata/RHSA-2019:2594 - https://access.redhat.com/errata/RHSA-2019:2662 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%282%29
CVE ID: CVE-2019-10357 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.501Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://access.redhat.com/errata/RHSA-2019:2651 - https://access.redhat.com/errata/RHSA-2019:2594 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2019:2651 - https://access.redhat.com/errata/RHSA-2019:2594 - https://access.redhat.com/errata/RHSA-2019:2662 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY1422
CVE ID: CVE-2019-10358 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.357Z Vendors: Jenkins project Products: Jenkins Maven Integration Plugin Description: Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713
CVE ID: CVE-2019-10359 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.367Z Vendors: Jenkins project Products: Jenkins Maven Release Plugin Description: A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1098
CVE ID: CVE-2019-10360 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.487Z Vendors: Jenkins project Products: Jenkins Maven Release Plugin Description: A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1184
CVE ID: CVE-2019-10361 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.590Z Vendors: Jenkins project Products: Jenkins Maven Release Plugin Description: Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://www.zerodayinitiative.com/advisories/ZDI-19-835/ - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
CVE ID: CVE-2019-10362 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.521Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
CVE ID: CVE-2019-10363 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.370Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1458
CVE ID: CVE-2019-10364 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.477Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-673
CVE ID: CVE-2019-10365 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.488Z Vendors: Jenkins project Products: Jenkins Google Kubernetes Engine Plugin Description: Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1345
CVE ID: CVE-2019-10366 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.576Z Vendors: Jenkins project Products: Jenkins Skytap Cloud CI Plugin Description: Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://www.zerodayinitiative.com/advisories/ZDI-19-833/ - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429
CVE ID: CVE-2019-10367 State: PUBLISHED Published: 2019-08-07T14:20:23 Last Updated: 2024-08-04T22:17:20.402Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1497
CVE ID: CVE-2019-10368 State: PUBLISHED Published: 2019-08-07T14:20:23 Last Updated: 2024-08-04T22:17:20.504Z Vendors: Jenkins project Products: Jenkins JClouds Plugin Description: A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins
Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482 - https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E - https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E - https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E
CVE ID: CVE-2019-10369 State: PUBLISHED Published: 2019-08-07T14:20:23 Last Updated: 2024-08-04T22:17:20.477Z Vendors: Jenkins project Products: Jenkins JClouds Plugin Description: A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/adv
ogram Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482 - https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E - https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E - https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E
CVE ID: CVE-2019-10370 State: PUBLISHED Published: 2019-08-07T14:20:23 Last Updated: 2024-08-04T22:17:20.508Z Vendors: Jenkins project Products: Jenkins Mask Passwords Plugin Description: Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-157
CVE ID: CVE-2019-10371 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.370Z Vendors: Jenkins project Products: Jenkins Gitlab Authentication Plugin Description: A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-795
CVE ID: CVE-2019-10372 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.596Z Vendors: Jenkins project Products: Jenkins Gitlab Authentication Plugin Description: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796
CVE ID: CVE-2019-10373 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.409Z Vendors: Jenkins project Products: Jenkins Build Pipeline Plugin Description: A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-879
CVE ID: CVE-2019-10374 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.368Z Vendors: Jenkins project Products: Jenkins PegDown Formatter Plugin Description: A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142
CVE ID: CVE-2019-10375 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.552Z Vendors: Jenkins project Products: Jenkins File System SCM Plugin Description: An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the contents of any file on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-569
CVE ID: CVE-2019-10376 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.555Z Vendors: Jenkins project Products: Jenkins Wall Display Plugin Description: A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-751
CVE ID: CVE-2019-10377 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.390Z Vendors: Jenkins project Products: Jenkins Avatar Plugin Description: A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1099
CVE ID: CVE-2019-10378 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.507Z Vendors: Jenkins project Products: Jenkins TestLink Plugin Description: Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://www.zerodayinitiative.com/advisories/ZDI-19-839/ - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1428
CVE ID: CVE-2019-10379 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.468Z Vendors: Jenkins project Products: Jenkins Google Cloud Messaging Notification Plugin Description: Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-591
CVE ID: CVE-2019-10380 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.571Z Vendors: Jenkins project Products: Jenkins Simple Travis Pipeline Runner Plugin Description: Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922
CVE ID: CVE-2019-10381 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.500Z Vendors: Jenkins project Products: Jenkins Codefresh Integration Plugin Description: Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-931
CVE ID: CVE-2019-10382 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.547Z Vendors: Jenkins project Products: Jenkins VMware Lab Manager Slaves Plugin Description: Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1376
CVE ID: CVE-2019-10383 State: PUBLISHED Published: 2019-08-28T15:30:16 Last Updated: 2024-08-04T22:17:20.544Z Vendors: Jenkins project Products: Jenkins Description: A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/28/4 - https://access.redhat.com/errata/RHSA-2019:2789 - https://access.redhat.com/errata/RHSA-2019:3144 - https://www.oracle.com/security-alerts/cpuapr2022.html - ht
019:2789 - https://access.redhat.com/errata/RHSA-2019:3144 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453
CVE ID: CVE-2019-10384 State: PUBLISHED Published: 2019-08-28T15:30:17 Last Updated: 2024-08-04T22:17:20.571Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/28/4 - https://access.redhat.com/errata/RHSA-2019:2789 - https://access.redhat.com/errata/RHSA-2019:3144 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.
ps://access.redhat.com/errata/RHSA-2019:3144 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1491
CVE ID: CVE-2019-10385 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.574Z Vendors: Jenkins project Products: Jenkins eggPlant Plugin Description: Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://www.zerodayinitiative.com/advisories/ZDI-19-834/ - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1430
CVE ID: CVE-2019-10386 State: PUBLISHED Published: 2019-08-07T14:20:24 Last Updated: 2024-08-04T22:17:20.376Z Vendors: Jenkins project Products: Jenkins XL TestView Plugin Description: A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-10
- http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1008
CVE ID: CVE-2019-10387 State: PUBLISHED Published: 2019-08-07T14:20:25 Last Updated: 2024-08-04T22:17:20.396Z Vendors: Jenkins project Products: Jenkins XL TestView Plugin Description: A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1008
CVE ID: CVE-2019-10388 State: PUBLISHED Published: 2019-08-07T14:20:25 Last Updated: 2024-08-04T22:17:20.636Z Vendors: Jenkins project Products: Jenkins Relution Enterprise Appstore Publisher Plugin Description: A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1053
CVE ID: CVE-2019-10389 State: PUBLISHED Published: 2019-08-07T14:20:25 Last Updated: 2024-08-04T22:17:20.522Z Vendors: Jenkins project Products: Jenkins Relution Enterprise Appstore Publisher Plugin Description: A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/07/1 - https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1053
CVE ID: CVE-2019-10390 State: PUBLISHED Published: 2019-08-28T15:30:17 Last Updated: 2024-08-04T22:17:20.412Z Vendors: Jenkins project Products: Jenkins Splunk Plugin Description: A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/28/4 - https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1294