Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Jenkins DotCi Plugin unspecified Clear all filters
TI-2022-19749 CVE-2022-41239 · GHSA-q9g4-9fx4-v533

Cross-site scripting in Jenkins DotCi Plugin

Priority LOW 26

Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerabili…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00705 Published 2022-09-21 No fix listed CWE-79
TI-2022-19748 CVE-2022-41238 · GHSA-9mc6-vgmq-x6xf

Missing authorization in Jenkins DotCi Plugin

Priority MEDIUM 44

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01146 Published 2022-09-21 No fix listed CWE-862
TI-2022-19747 CVE-2022-41237 · GHSA-x3jj-rgw9-7r5g

Deserialization of untrusted data in Jenkins DotCi Plugin

Priority MEDIUM 52

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01684 Published 2022-09-21 No fix listed CWE-502