Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-10335 · ADVISORY
• jenkinsci/electricflow-plugin commit 1a90ee7 · WEB
• jenkins.io/security/advisory/2019-06-11 · WEB
• web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747 · WEB
• openwall.com/lists/oss-security/2019/06/11/1 · WEB
• securityfocus.com/bid/108747

Lỗ hổng khác của org.jenkins-ci.plugins:electricflow

• CVE-2023-46655TRUNG BÌNH 6.5Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish…
• CVE-2023-46654CAO 8.1Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc…
• CVE-2021-21647TRUNG BÌNH 4.3Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read pe…
• CVE-2019-10336TRUNG BÌNH 6.1A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output…
• CVE-2019-10334TRUNG BÌNH 6.5Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartU…