Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-2177 State: PUBLISHED Published: 2020-04-16T13:35:16 Last Updated: 2024-08-04T07:01:41.116Z Vendors: Jenkins project Products: Jenkins Copr Plugin Description: Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1556 - http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE ID: CVE-2020-2178 State: PUBLISHED Published: 2020-04-16T13:35:16 Last Updated: 2024-08-04T07:01:40.974Z Vendors: Jenkins project Products: Jenkins Parasoft Findings Plugin Description: Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1753 - http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE ID: CVE-2020-2179 State: PUBLISHED Published: 2020-04-16T13:35:17 Last Updated: 2024-08-04T07:01:40.964Z Vendors: Jenkins project Products: Jenkins Yaml Axis Plugin Description: Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1825 - http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE ID: CVE-2020-2180 State: PUBLISHED Published: 2020-04-16T13:35:17 Last Updated: 2024-08-04T07:01:41.022Z Vendors: Jenkins project Products: Jenkins AWS SAM Plugin Description: Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1736 - http://www.openwall.com/lists/oss-security/2020/04/16/4
CVE ID: CVE-2020-2181 State: PUBLISHED Published: 2020-05-06T12:45:22 Last Updated: 2024-08-04T07:01:40.930Z Vendors: Jenkins project Products: Jenkins Credentials Binding Plugin Description: Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2182 State: PUBLISHED Published: 2020-05-06T12:45:23 Last Updated: 2024-08-04T07:01:40.977Z Vendors: Jenkins project Products: Jenkins Credentials Binding Plugin Description: Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2183 State: PUBLISHED Published: 2020-05-06T12:45:23 Last Updated: 2024-08-04T07:01:41.061Z Vendors: Jenkins project Products: Jenkins Copy Artifact Plugin Description: Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-988 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2184 State: PUBLISHED Published: 2020-05-06T12:45:23 Last Updated: 2024-08-04T07:01:40.935Z Vendors: Jenkins project Products: Jenkins CVS Plugin Description: A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1094 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2185 State: PUBLISHED Published: 2020-05-06T12:45:24 Last Updated: 2024-08-04T07:01:41.222Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-381 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2186 State: PUBLISHED Published: 2020-05-06T12:45:24 Last Updated: 2024-08-04T07:01:40.963Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1408 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2187 State: PUBLISHED Published: 2020-05-06T12:45:25 Last Updated: 2024-08-04T07:01:40.945Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1528 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2188 State: PUBLISHED Published: 2020-05-06T12:45:25 Last Updated: 2024-08-04T07:01:40.958Z Vendors: Jenkins project Products: Jenkins Amazon EC2 Plugin Description: A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1844 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2189 State: PUBLISHED Published: 2020-05-06T12:45:26 Last Updated: 2024-08-04T07:01:41.129Z Vendors: Jenkins project Products: Jenkins SCM Filter Jervis Plugin Description: Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1826 - http://www.openwall.com/lists/oss-security/2020/05/06/3
CVE ID: CVE-2020-2190 State: PUBLISHED Published: 2020-06-03T12:40:23 Last Updated: 2024-08-04T07:01:41.240Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1866 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2191 State: PUBLISHED Published: 2020-06-03T12:40:23 Last Updated: 2024-08-04T07:01:41.000Z Vendors: Jenkins project Products: Jenkins Self-Organizing Swarm Plug-in Modules Plugin Description: Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2192 State: PUBLISHED Published: 2020-06-03T12:40:23 Last Updated: 2024-08-04T07:01:40.974Z Vendors: Jenkins project Products: Jenkins Self-Organizing Swarm Plug-in Modules Plugin Description: A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2193 State: PUBLISHED Published: 2020-06-03T12:40:24 Last Updated: 2024-08-04T07:01:41.151Z Vendors: Jenkins project Products: Jenkins ECharts API Plugin Description: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1841 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2194 State: PUBLISHED Published: 2020-06-03T12:40:24 Last Updated: 2024-08-04T07:01:41.090Z Vendors: Jenkins project Products: Jenkins ECharts API Plugin Description: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1842 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2195 State: PUBLISHED Published: 2020-06-03T12:40:25 Last Updated: 2024-08-04T07:01:41.072Z Vendors: Jenkins project Products: Jenkins Compact Columns Plugin Description: Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1837 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2196 State: PUBLISHED Published: 2020-06-03T12:40:25 Last Updated: 2024-08-04T07:01:41.041Z Vendors: Jenkins project Products: Jenkins Selenium Plugin Description: Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766 - http://www.openwall.com/lists/oss-security/2020/06/03/3 - http://www.openwall.com/lists/oss-security/2022/04/14/2
CVE ID: CVE-2020-2197 State: PUBLISHED Published: 2020-06-03T12:40:26 Last Updated: 2024-08-04T07:01:41.113Z Vendors: Jenkins project Products: Jenkins Project Inheritance Plugin Description: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2198 State: PUBLISHED Published: 2020-06-03T12:40:26 Last Updated: 2024-08-04T07:01:41.160Z Vendors: Jenkins project Products: Jenkins Project Inheritance Plugin Description: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2199 State: PUBLISHED Published: 2020-06-03T12:40:26 Last Updated: 2024-08-04T07:01:41.151Z Vendors: Jenkins project Products: Jenkins Subversion Partial Release Manager Plugin Description: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1726 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2200 State: PUBLISHED Published: 2020-06-03T12:40:27 Last Updated: 2024-08-04T07:01:41.254Z Vendors: Jenkins project Products: Jenkins Play Framework Plugin Description: Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1879 - http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE ID: CVE-2020-2201 State: PUBLISHED Published: 2020-07-02T14:55:32 Last Updated: 2024-08-04T07:01:41.081Z Vendors: Jenkins project Products: Jenkins Sonargraph Integration Plugin Description: Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1775 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2202 State: PUBLISHED Published: 2020-07-02T14:55:33 Last Updated: 2024-08-04T07:01:41.113Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Plugin Description: A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1690 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2203 State: PUBLISHED Published: 2020-07-02T14:55:33 Last Updated: 2024-08-04T07:01:41.158Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Plugin Description: A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1691 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2204 State: PUBLISHED Published: 2020-07-02T14:55:34 Last Updated: 2024-08-04T07:01:41.183Z Vendors: Jenkins project Products: Jenkins Fortify on Demand Plugin Description: A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1691 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2205 State: PUBLISHED Published: 2020-07-02T14:55:34 Last Updated: 2024-08-04T07:01:41.048Z Vendors: Jenkins project Products: Jenkins VncRecorder Plugin Description: Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1728%20%281%29 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2206 State: PUBLISHED Published: 2020-07-02T14:55:34 Last Updated: 2024-08-04T07:01:41.180Z Vendors: Jenkins project Products: Jenkins VncRecorder Plugin Description: Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1728%20%282%29 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2207 State: PUBLISHED Published: 2020-07-02T14:55:35 Last Updated: 2024-08-04T07:01:41.184Z Vendors: Jenkins project Products: Jenkins VncViewer Plugin Description: Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1776 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2208 State: PUBLISHED Published: 2020-07-02T14:55:35 Last Updated: 2024-08-04T07:01:41.139Z Vendors: Jenkins project Products: Jenkins Slack Upload Plugin Description: Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1627 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2209 State: PUBLISHED Published: 2020-07-02T14:55:36 Last Updated: 2024-08-04T07:01:41.258Z Vendors: Jenkins project Products: Jenkins TestComplete support Plugin Description: Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1686 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2210 State: PUBLISHED Published: 2020-07-02T14:55:36 Last Updated: 2024-08-04T07:01:41.190Z Vendors: Jenkins project Products: Jenkins Stash Branch Parameter Plugin Description: Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1656 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2211 State: PUBLISHED Published: 2020-07-02T14:55:37 Last Updated: 2024-08-04T07:01:41.119Z Vendors: Jenkins project Products: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Description: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1738 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2212 State: PUBLISHED Published: 2020-07-02T14:55:37 Last Updated: 2024-08-04T07:01:41.230Z Vendors: Jenkins project Products: Jenkins GitHub Coverage Reporter Plugin Description: Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system or read permissions on the system configuration. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1632 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2213 State: PUBLISHED Published: 2020-07-02T14:55:37 Last Updated: 2024-08-04T07:01:41.243Z Vendors: Jenkins project Products: Jenkins White Source Plugin Description: Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission (config.xml), or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1630 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2214 State: PUBLISHED Published: 2020-07-02T14:55:38 Last Updated: 2024-08-04T07:01:41.063Z Vendors: Jenkins project Products: Jenkins ZAP Pipeline Plugin Description: Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1811 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2215 State: PUBLISHED Published: 2020-07-02T14:55:38 Last Updated: 2024-08-04T07:01:41.109Z Vendors: Jenkins project Products: Jenkins Zephyr for JIRA Test Management Plugin Description: A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1762 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2216 State: PUBLISHED Published: 2020-07-02T14:55:39 Last Updated: 2024-08-04T07:01:41.249Z Vendors: Jenkins project Products: Jenkins Zephyr for JIRA Test Management Plugin Description: A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1762 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2217 State: PUBLISHED Published: 2020-07-02T14:55:39 Last Updated: 2024-08-04T07:01:41.244Z Vendors: Jenkins project Products: Jenkins Compatibility Action Storage Plugin Description: Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1771 - http://www.openwall.com/lists/oss-security/2020/07/02/7
CVE ID: CVE-2020-2218 State: PUBLISHED Published: 2020-07-02T14:55:39 Last Updated: 2024-08-04T07:01:41.118Z Vendors: Jenkins project Products: Jenkins HP ALM Quality Center Plugin Description: Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1576 - http://www.openwall.com/lists/oss-security/2020/07/02/7