BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Releases - February 2018

jenkins-2018-02 Feb 1, 2018 Source: Vendor

Jenkins security advisories for February 2018: 12 CVEs, 7 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

12 lines
All 12 CVEs 12 Additional recognition 0 Unclaimed only
Showing 1–12 of 12 matching , clear filters
CVE-2018-1000067 BR2018-0000-041258 SECURITY-506 unclaimed
Improperly secured form validation for proxy configuration allowed Server-Side Request Forgery
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000068 BR2018-0000-041259 SECURITY-717 unclaimed
Improper input validation allows unintended access to plugin resource files on case-insensitive file systems
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000104 BR2018-0000-041260 SECURITY-260 unclaimed
Coverity Plugin stored keystore and private key passwords in plain text
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000105 BR2018-0000-041261 SECURITY-402 unclaimed
Improper access control in Gerrit Trigger Plugin allowed unauthorized users to read some server configuration information
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000106 BR2018-0000-041262 SECURITY-403 unclaimed
Improper access control in Gerrit Trigger Plugin allowed unauthorized users to modify global Gerrit Server configurations
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000107 BR2018-0000-041263 SECURITY-498 unclaimed
Improper access control allowed users without ManageOwnership permission to change job ownership metadata in Job and Node ownership Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000108 BR2018-0000-041264 SECURITY-712 unclaimed
Reflected cross-site-scripting vulnerability in report URL of CppNCSS Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000109 BR2018-0000-041265 SECURITY-715 unclaimed
Unprivileged users are able to enumerate credential IDs in Google Play Android Publisher Plugin
Credited as Christopher Orr
CVE-2018-1000110 BR2018-0000-041266 SECURITY-723 unclaimed
Disclosure of user names and node names to unauthorized users through post-commit hook URL in Git Plugin
Credited as Spencer Gietzen of Rhino Security Labs
CVE-2018-1000113 BR2018-0000-041267 SECURITY-731 unclaimed
Stored cross-site scripting vulnerability in TestLink Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000114 BR2018-0000-041268 SECURITY-746 unclaimed
Promoted Builds Plugin allowed unauthorized users to run some promotion processes
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2018-6356 BR2018-0000-041269 SECURITY-705 unclaimed
Path traversal vulnerability allows access to files outside plugin resources
Credited as Kapil Kulkarni