TI-2020-17201 CVE-2020-28362 · GHSA-gff4-9rfx-4pcw
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Priority LOW 39
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
RHSA-2021:0038
OpenShift Container Platform 4.6.12 packages and security update
Released 2021-01-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.6 cri-o-1.19.1-2.rhaos4.6.git2af9ecf.el8, jenkins-2-plugins-4.6.1608634578-1.el7, jenkins-2-plugins-4.6.1609853716-1.el8 +8
Fixes 7 records
TI-2020-02182 CVE-2020-2305 · GHSA-x58r-wxc3-7pqr
XML external entity injection in Jenkins Mercurial Plugin
Priority LOW 32
Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
TI-2020-02181 CVE-2020-2304 · GHSA-vp5f-8jgw-j53c
XML external entity injection in Jenkins Subversion Plugin
Priority LOW 32
Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
TI-2020-02186 CVE-2020-2309 · GHSA-g2r3-4g8q-h5rj
Missing authorization in Jenkins Kubernetes Plugin
Priority LOW 22
A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
TI-2020-02185 CVE-2020-2308 · GHSA-rr6j-37cv-c7x7
Missing authorization in Jenkins Kubernetes Plugin
Priority LOW 22
A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.
TI-2020-02184 CVE-2020-2307 · GHSA-fh5w-p2j4-4p8x
Information disclosure in Jenkins Kubernetes Plugin
Priority LOW 22
Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables.
TI-2020-02183 CVE-2020-2306 · GHSA-vrrc-3wwh-frgx
Missing authorization in Jenkins Mercurial Plugin
Priority LOW 22
A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.