Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-2219 State: PUBLISHED Published: 2020-07-02T14:55:40 Last Updated: 2024-08-04T07:01:41.123Z Vendors: Jenkins project Products: Jenkins Link Column Plugin Description: Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1803 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2220 State: PUBLISHED Published: 2020-07-15T17:00:26 Last Updated: 2024-08-04T07:01:41.248Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1868 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2221 State: PUBLISHED Published: 2020-07-15T17:00:26 Last Updated: 2024-08-04T07:01:41.082Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1901 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2222 State: PUBLISHED Published: 2020-07-15T17:00:26 Last Updated: 2024-08-04T07:01:41.127Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1902 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2223 State: PUBLISHED Published: 2020-07-15T17:00:27 Last Updated: 2024-08-04T07:01:41.099Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1945 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2224 State: PUBLISHED Published: 2020-07-15T17:00:27 Last Updated: 2024-08-04T07:01:41.171Z Vendors: Jenkins project Products: Jenkins Matrix Project Plugin Description: Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1924 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2225 State: PUBLISHED Published: 2020-07-15T17:00:28 Last Updated: 2024-08-04T07:01:41.253Z Vendors: Jenkins project Products: Jenkins Matrix Project Plugin Description: Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1925 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2226 State: PUBLISHED Published: 2020-07-15T17:00:28 Last Updated: 2024-08-04T07:01:41.175Z Vendors: Jenkins project Products: Jenkins Matrix Authorization Strategy Plugin Description: Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1909 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2227 State: PUBLISHED Published: 2020-07-15T17:00:29 Last Updated: 2024-08-04T07:01:41.251Z Vendors: Jenkins project Products: Jenkins Deployer Framework Plugin Description: Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1915 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2228 State: PUBLISHED Published: 2020-07-15T17:00:29 Last Updated: 2024-08-04T07:01:41.088Z Vendors: Jenkins project Products: Jenkins Gitlab Authentication Plugin Description: Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1792 - http://www.openwall.com/lists/oss-security/2020/07/15/5
CVE ID: CVE-2020-2229 State: PUBLISHED Published: 2020-08-12T13:25:21 Last Updated: 2024-08-04T07:01:41.164Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955 - http://www.openwall.com/lists/oss-security/2020/08/12/4 - http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html
CVE ID: CVE-2020-2230 State: PUBLISHED Published: 2020-08-12T13:25:21 Last Updated: 2024-08-04T07:01:41.176Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957 - http://www.openwall.com/lists/oss-security/2020/08/12/4 - http://packetstormsecurity.com/files/160443/Jenkins-2.235.3-Cross-Site-Scripting.html
CVE ID: CVE-2020-2231 State: PUBLISHED Published: 2020-08-12T13:25:22 Last Updated: 2024-08-04T07:01:41.196Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960 - http://www.openwall.com/lists/oss-security/2020/08/12/4 - http://packetstormsecurity.com/files/160616/J
#SECURITY-1960 - http://www.openwall.com/lists/oss-security/2020/08/12/4 - http://packetstormsecurity.com/files/160616/Jenkins-2.251-LTS-2.235.3-Cross-Site-Scripting.html
CVE ID: CVE-2020-2232 State: PUBLISHED Published: 2020-08-12T13:25:22 Last Updated: 2024-08-04T07:01:41.190Z Vendors: Jenkins project Products: Jenkins Email Extension Plugin Description: Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1975 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2233 State: PUBLISHED Published: 2020-08-12T13:25:23 Last Updated: 2024-08-04T07:01:41.251Z Vendors: Jenkins project Products: Jenkins Pipeline Maven Integration Plugin Description: A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20%281%29 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2234 State: PUBLISHED Published: 2020-08-12T13:25:23 Last Updated: 2024-08-04T07:01:41.133Z Vendors: Jenkins project Products: Jenkins Pipeline Maven Integration Plugin Description: A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20%282%29 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2235 State: PUBLISHED Published: 2020-08-12T13:25:24 Last Updated: 2024-08-04T07:01:41.114Z Vendors: Jenkins project Products: Jenkins Pipeline Maven Integration Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1794%20%282%29 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2236 State: PUBLISHED Published: 2020-08-12T13:25:24 Last Updated: 2024-08-04T07:01:41.283Z Vendors: Jenkins project Products: Jenkins Yet Another Build Visualizer Plugin Description: Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1940 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2237 State: PUBLISHED Published: 2020-08-12T13:25:24 Last Updated: 2024-08-04T07:01:41.257Z Vendors: Jenkins project Products: Jenkins Flaky Test Handler Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous git revision. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1763 - http://www.openwall.com/lists/oss-security/2020/08/12/4
CVE ID: CVE-2020-2238 State: PUBLISHED Published: 2020-09-01T13:50:30 Last Updated: 2024-08-04T07:01:41.300Z Vendors: Jenkins project Products: Jenkins Git Parameter Plugin Description: Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1884 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2239 State: PUBLISHED Published: 2020-09-01T13:50:30 Last Updated: 2024-08-04T07:01:41.273Z Vendors: Jenkins project Products: Jenkins Parameterized Remote Trigger Plugin Description: Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1625 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2240 State: PUBLISHED Published: 2020-09-01T13:50:31 Last Updated: 2024-08-04T07:01:41.126Z Vendors: Jenkins project Products: Jenkins database Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1023 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2241 State: PUBLISHED Published: 2020-09-01T13:50:31 Last Updated: 2024-08-04T07:01:41.167Z Vendors: Jenkins project Products: Jenkins database Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1024 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2242 State: PUBLISHED Published: 2020-09-01T13:50:32 Last Updated: 2024-08-04T07:01:41.169Z Vendors: Jenkins project Products: Jenkins database Plugin Description: A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1024 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2243 State: PUBLISHED Published: 2020-09-01T13:50:32 Last Updated: 2024-08-04T07:01:41.183Z Vendors: Jenkins project Products: Jenkins Cadence vManager Plugin Description: Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1936 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2244 State: PUBLISHED Published: 2020-09-01T13:50:32 Last Updated: 2024-08-04T07:01:41.168Z Vendors: Jenkins project Products: Jenkins Build Failure Analyzer Plugin Description: Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1770 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2245 State: PUBLISHED Published: 2020-09-01T13:50:33 Last Updated: 2024-08-04T07:01:41.252Z Vendors: Jenkins project Products: Jenkins Valgrind Plugin Description: Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1829 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2246 State: PUBLISHED Published: 2020-09-01T13:50:33 Last Updated: 2024-08-04T07:01:41.498Z Vendors: Jenkins project Products: Jenkins Valgrind Plugin Description: Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1830 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2247 State: PUBLISHED Published: 2020-09-01T13:50:34 Last Updated: 2024-08-04T07:01:41.186Z Vendors: Jenkins project Products: Jenkins Klocwork Analysis Plugin Description: Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1831 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2248 State: PUBLISHED Published: 2020-09-01T13:50:34 Last Updated: 2024-08-04T07:01:41.186Z Vendors: Jenkins project Products: Jenkins JSGames Plugin Description: Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1905 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2249 State: PUBLISHED Published: 2020-09-01T13:50:35 Last Updated: 2024-08-04T07:01:41.291Z Vendors: Jenkins project Products: Jenkins Team Foundation Server Plugin Description: Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2250 State: PUBLISHED Published: 2020-09-01T13:50:35 Last Updated: 2024-08-04T07:01:41.201Z Vendors: Jenkins project Products: Jenkins SoapUI Pro Functional Testing Plugin Description: Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%281%29 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2251 State: PUBLISHED Published: 2020-09-01T13:50:35 Last Updated: 2024-08-04T07:01:41.308Z Vendors: Jenkins project Products: Jenkins SoapUI Pro Functional Testing Plugin Description: Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1631%20%282%29 - http://www.openwall.com/lists/oss-security/2020/09/01/3
CVE ID: CVE-2020-2252 State: PUBLISHED Published: 2020-09-16T13:20:38 Last Updated: 2024-08-04T07:01:41.144Z Vendors: Jenkins project Products: Jenkins Mailer Plugin Description: Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2253 State: PUBLISHED Published: 2020-09-16T13:20:39 Last Updated: 2024-08-04T07:01:41.510Z Vendors: Jenkins project Products: Jenkins Email Extension Plugin Description: Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1851 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2254 State: PUBLISHED Published: 2020-09-16T13:20:39 Last Updated: 2024-08-04T07:01:41.187Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugin Description: Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2255 State: PUBLISHED Published: 2020-09-16T13:20:40 Last Updated: 2024-08-04T07:01:41.230Z Vendors: Jenkins project Products: Jenkins Blue Ocean Plugin Description: A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1961 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2256 State: PUBLISHED Published: 2020-09-16T13:20:40 Last Updated: 2024-08-04T07:01:41.290Z Vendors: Jenkins project Products: Jenkins Pipeline Maven Integration Plugin Description: Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1976 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2257 State: PUBLISHED Published: 2020-09-16T13:20:41 Last Updated: 2024-08-04T07:01:41.167Z Vendors: Jenkins project Products: Jenkins Validating String Parameter Plugin Description: Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1935 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2258 State: PUBLISHED Published: 2020-09-16T13:20:41 Last Updated: 2024-08-04T07:01:41.275Z Vendors: Jenkins project Products: Jenkins Health Advisor by CloudBees Plugin Description: Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view that HTTP endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1998 - http://www.openwall.com/lists/oss-security/2020/09/16/3
CVE ID: CVE-2020-2259 State: PUBLISHED Published: 2020-09-16T13:20:41 Last Updated: 2024-08-04T07:01:41.206Z Vendors: Jenkins project Products: Jenkins computer-queue-plugin Plugin Description: Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1912 - http://www.openwall.com/lists/oss-security/2020/09/16/3