TI-2022-20306 CVE-2022-41966 · GHSA-j563-grx4-pjpv
XStream Denial of Service via stack overflow
Priority HIGH 75
XStream serializes Java objects to XML and back again.
RHSA-2023:3625
OpenShift Container Platform 4.10.62 security update
Released 2023-06-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1685679861-1.el8, jenkins-2.401.1.1685677065-1.el8
Fixes 6 records
TI-2023-07279 CVE-2023-20860 · GHSA-7phw-cxx7-q9vq
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern…
Priority MEDIUM 45
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spri…
TI-2023-16169 CVE-2023-32981 · GHSA-6987-xccv-fhjp
Out-of-bounds write in Jenkins Pipeline Utility Steps Plugin
Priority MEDIUM 42
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file sys…
TI-2023-16165 CVE-2023-32977 · GHSA-2wvv-phhw-qvmc
Cross-site scripting in Jenkins Pipeline: Job Plugin
Priority LOW 25
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set b…
TI-2023-16167 CVE-2023-32979 · GHSA-6gp4-2f92-j2w5
Incorrect permission assignment in Jenkins Email Extension Plugin
Priority LOW 21
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ dir…
TI-2023-16168 CVE-2023-32980 · GHSA-2f89-66v2-9p53
Cross-site request forgery in Jenkins Email Extension Plugin
Priority LOW 20
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.