BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Advisory 2021-01-13

2021-01-13 Jan 13, 2021 Source: Vendor

Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2021-01-13/. 13 SECURITY issues listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.jenkins.io/security/advisory/2021-01-13/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

16 lines
All 16 CVEs 16 Additional recognition 0 Unclaimed only
Showing 1–16 of 16
CVE-2021-21609 BR2021-0000-014381 SECURITY-2047 unclaimed
Missing permission check for paths with specific prefix
Credited as Daniel Beck, CloudBees, Inc.
CVE-2021-21613 BR2021-0000-014382 SECURITY-2098 unclaimed
XSS vulnerability in TICS Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2021-21610 BR2021-0000-014383 SECURITY-2153 unclaimed
Reflected XSS vulnerability in markup formatter preview
Credited as Daniel Beck, CloudBees, Inc.
CVE-2021-21604 BR2021-0000-014384 SECURITY-1923 unclaimed
Improper handling of REST API XML deserialization errors
Credited as Ismail Aydemir at d0nkeysec.org
CVE-2021-21603 BR2021-0000-014385 SECURITY-1889 unclaimed
XSS vulnerability in notification bar
Credited as Jeff Thompson, CloudBees, Inc., Matt Sicker, CloudBees, Inc.
CVE-2021-21603 BR2021-0000-014386 SECURITY-1889 unclaimed
XSS vulnerability in notification bar
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2021-21611 BR2021-0000-014387 SECURITY-2171 unclaimed
Stored XSS vulnerability on new item page
Credited as Jesse Glick, CloudBees, Inc.
CVE-2021-21611 BR2021-0000-014388 SECURITY-2171 unclaimed
Stored XSS vulnerability on new item page
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2021-21612 BR2021-0000-014389 SECURITY-2057 unclaimed
Credentials stored in plain text by tracetronic ecu.test Plugin
Credited as Long Nguyen, Viettel Cyber Security
CVE-2021-21608 BR2021-0000-014390 SECURITY-2035 unclaimed
Stored XSS vulnerability in button labels
Credited as Matt Sicker, CloudBees, Inc.
CVE-2021-21608 BR2021-0000-014391 SECURITY-2035 unclaimed
Stored XSS vulnerability in button labels
Credited as Jesse Glick, CloudBees, Inc.
CVE-2021-21614 BR2021-0000-014392 SECURITY-2156 unclaimed
Credentials stored in plain text by Bumblebee HP ALM Plugin
Credited as Son Nguyen (@s0nnguy3n_)
CVE-2021-21602 BR2021-0000-014393 SECURITY-1452 unclaimed
Arbitrary file read vulnerability in workspace browsers
Credited as Travis Emmert from Apple Information Security
CVE-2021-21605 BR2021-0000-014394 SECURITY-2021 unclaimed
Path traversal vulnerability in agent names
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2021-21606 BR2021-0000-014395 SECURITY-2023 unclaimed
Arbitrary file existence check in file fingerprints
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2021-21607 BR2021-0000-014396 SECURITY-2025 unclaimed
Excessive memory allocation in graph URLs leads to denial of service
Credited as Wadeck Follonier, CloudBees, Inc.