Jenkins allows Cross-Site Scripting (XSS)

Description

References

• nvd.nist.gov/vuln/detail/CVE-2011-4344 · ADVISORY
• jenkinsci/winstone commit 410ed30 · WEB
• jenkinsci/jenkins · PACKAGE
• web.archive.org/web/20200229031004/https://www.securityfocus.com/bid/50786 · WEB
• groups.google.com/group/jenkinsci-advisories/msg/1b94588f90f876b5 · WEB
• openwall.com/lists/oss-security/2011/11/23/5 · WEB
• openwall.com/lists/oss-security/2011/11/23/6 · WEB
• cloudbees.com/jenkins-advisory/jenkins-security-advisory-2011-11-08.cb · WEB
• secunia.com/advisories/46911
• securityfocus.com/bid/50786

Mais vulnerabilidades de org.jenkins-ci.main:jenkins-core

• CVE-2026-53442MÉDIO 5.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf…
• CVE-2026-53441MÉDIO 5.4Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of …
• CVE-2026-53440MÉDIO 4.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security…
• CVE-2026-53439MÉDIO 4.3Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot…
• CVE-2026-53438MÉDIO 4.3A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I…