Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10322 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.464Z Vendors: Jenkins project Products: Jenkins Artifactory Plugin Description: A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://www.talosintelligen
www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29
CVE ID: CVE-2019-10323 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.389Z Vendors: Jenkins project Products: Jenkins Artifactory Plugin Description: A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0846 - https://jenkins.io/security/advisory/2019-05-31/#SECURIT
w.talosintelligence.com/vulnerability_reports/TALOS-2019-0846 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%282%29
CVE ID: CVE-2019-10324 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.451Z Vendors: Jenkins project Products: Jenkins Artifactory Plugin Description: A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.sec
t Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1347
CVE ID: CVE-2019-10325 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.429Z Vendors: Jenkins project Products: Jenkins Warnings NG Plugin Description: A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1373
CVE ID: CVE-2019-10326 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.354Z Vendors: Jenkins project Products: Jenkins Warnings NG Plugin Description: A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1391
CVE ID: CVE-2019-10327 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.349Z Vendors: Jenkins project Products: Jenkins Pipeline Maven Integration Plugin Description: An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss
l-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1409
CVE ID: CVE-2019-10328 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.492Z Vendors: Jenkins project Products: Jenkins Pipeline Remote Loader Plugin Description: Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://access.redhat.com/errata/RHBA-2019:1605 - https://access.redhat.com/errata/RHSA-2019:1636 - https://jenkins.io/security/advisory/2019-05-31
rrata/RHBA-2019:1605 - https://access.redhat.com/errata/RHSA-2019:1636 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921
CVE ID: CVE-2019-10329 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.389Z Vendors: Jenkins project Products: Jenkins InfluxDB Plugin Description: Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1403
CVE ID: CVE-2019-10330 State: PUBLISHED Published: 2019-05-31T14:20:19 Last Updated: 2024-08-04T22:17:20.462Z Vendors: Jenkins project Products: Jenkins Gitea Plugin Description: Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/05/31/2 - http://www.securityfocus.com/bid/108540 - https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1046
CVE ID: CVE-2019-10331 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.381Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%281%29
CVE ID: CVE-2019-10332 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.419Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%281%29
CVE ID: CVE-2019-10333 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.588Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%282%29
CVE ID: CVE-2019-10334 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.486Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411
CVE ID: CVE-2019-10335 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.471Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1412
CVE ID: CVE-2019-10336 State: PUBLISHED Published: 2019-06-11T13:15:26 Last Updated: 2024-08-04T22:17:20.379Z Vendors: Jenkins project Products: Jenkins ElectricFlow Plugin Description: A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420
CVE ID: CVE-2019-10337 State: PUBLISHED Published: 2019-06-11T13:15:27 Last Updated: 2024-08-04T22:17:20.365Z Vendors: Jenkins project Products: Jenkins Token Macro Plugin Description: An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://
ferences: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://access.redhat.com/errata/RHSA-2019:1636 - https://access.redhat.com/errata/RHSA-2019:1851 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399
CVE ID: CVE-2019-10338 State: PUBLISHED Published: 2019-06-11T13:15:27 Last Updated: 2024-08-04T22:17:20.484Z Vendors: Jenkins project Products: Jenkins JX Resources Plugin Description: A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1379
CVE ID: CVE-2019-10339 State: PUBLISHED Published: 2019-06-11T13:15:27 Last Updated: 2024-08-04T22:17:20.384Z Vendors: Jenkins project Products: Jenkins JX Resources Plugin Description: A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/06/11/1 - http://www.securityfocus.com/bid/108747 - https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1379
CVE ID: CVE-2019-10340 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.329Z Vendors: Jenkins project Products: Jenkins Docker Plugin Description: A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/ad
.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010
CVE ID: CVE-2019-10341 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.391Z Vendors: Jenkins project Products: Jenkins Docker Plugin Description: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-1
sts/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010
CVE ID: CVE-2019-10342 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.358Z Vendors: Jenkins project Products: Jenkins Docker Plugin Description: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1400
CVE ID: CVE-2019-10343 State: PUBLISHED Published: 2019-07-31T12:45:20 Last Updated: 2024-08-04T22:17:20.486Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1279
CVE ID: CVE-2019-10344 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.383Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1290
CVE ID: CVE-2019-10345 State: PUBLISHED Published: 2019-07-31T12:45:21 Last Updated: 2024-08-04T22:17:20.474Z Vendors: Jenkins project Products: Jenkins Configuration as Code Plugin Description: Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/31/1 - https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1303
CVE ID: CVE-2019-10346 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.382Z Vendors: Jenkins project Products: Jenkins Embeddable Build Status Plugin Description: A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419
CVE ID: CVE-2019-10347 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.401Z Vendors: Jenkins project Products: Jenkins Mashup Portlets Plugin Description: Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775
CVE ID: CVE-2019-10348 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.471Z Vendors: Jenkins project Products: Jenkins Gogs Plugin Description: Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://www.zerodayinitiative.com/advisories/ZDI-19-837/ - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438
CVE ID: CVE-2019-10349 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.334Z Vendors: Jenkins project Products: Jenkins Dependency Graph Viewer Plugin Description: A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/
curity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/109156 - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177
CVE ID: CVE-2019-10350 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.351Z Vendors: Jenkins project Products: Jenkins Port Allocator Plugin Description: Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://www.zerodayinitiative.com/advisories/ZDI-19-838/ - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1441
CVE ID: CVE-2019-10351 State: PUBLISHED Published: 2019-07-11T13:55:17 Last Updated: 2024-08-04T22:17:20.465Z Vendors: Jenkins project Products: Jenkins Caliper CI Plugin Description: Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/11/4 - http://www.securityfocus.com/bid/109156 - https://www.zerodayinitiative.com/advisories/ZDI-19-836/ - https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437
CVE ID: CVE-2019-10352 State: PUBLISHED Published: 2019-07-17T15:45:13 Last Updated: 2024-08-04T22:17:20.356Z Vendors: Jenkins project Products: Jenkins Description: A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-35 - http://www.openwall.com/lists/oss-security/2019/07/17/2 - htt
- https://www.tenable.com/security/research/tra-2019-35 - http://www.openwall.com/lists/oss-security/2019/07/17/2 - http://www.securityfocus.com/bid/109299 - https://access.redhat.com/errata/RHSA-2019:2503 - https://access.redhat.com/errata/RHSA-2019:2548 - https://jenkins.io/security/advisory/2019-07-17/#SECURITY-1424
CVE ID: CVE-2019-10353 State: PUBLISHED Published: 2019-07-17T15:45:13 Last Updated: 2024-08-04T22:17:20.468Z Vendors: Jenkins project Products: Jenkins Description: CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/17/2 - http://www.securityfocus.com/bid/109373 - https://access.redhat.com/errata/RHSA-2019:2503 - https://access.redhat.com/errata/RHSA-2019:2548 - https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626
CVE ID: CVE-2019-10354 State: PUBLISHED Published: 2019-07-17T15:45:13 Last Updated: 2024-08-04T22:17:20.331Z Vendors: Jenkins project Products: Jenkins Description: A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/07/17/2 - http://www.securityfocus.com/bid/109373 - https://access.redhat.com/errata/RHSA-2019:2503 - https://access.redhat.com/errata/RHSA-2019:2548 - https://jenkins.io/security/advisory/2019
.com/errata/RHSA-2019:2503 - https://access.redhat.com/errata/RHSA-2019:2548 - https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534