BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Releases - July 2018

jenkins-2018-07 Jul 1, 2018 Source: Vendor

Jenkins security advisories for July 2018: 23 CVEs, 7 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

23 lines
All 23 CVEs 23 Additional recognition 0 Unclaimed only
Showing 1–23 of 23
CVE-2018-1999001 BR2018-0000-041318 SECURITY-897 unclaimed
Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart
Credited as Nimrod Stoler of CyberArk Labs
CVE-2018-1999002 BR2018-0000-041319 SECURITY-914 unclaimed
Arbitrary file read vulnerability
Credited as Orange Tsai(@orange_8361) from DEVCORE
CVE-2018-1999003 BR2018-0000-041320 SECURITY-891 unclaimed
Unauthorized users could cancel queued builds
Credited as Nimrod Stoler of CyberArk Labs
CVE-2018-1999004 BR2018-0000-041321 SECURITY-892 unclaimed
Unauthorized users could initiate and abort agent launches
Credited as Nimrod Stoler of CyberArk Labs
CVE-2018-1999005 BR2018-0000-041322 SECURITY-944 unclaimed
Stored XSS vulnerability
Credited as AZZAZ Yasmine, IT Security Engineer
CVE-2018-1999006 BR2018-0000-041323 SECURITY-925 unclaimed
Unauthorized users are able to determine when a plugin was extracted from its JPI package
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1999007 BR2018-0000-041324 SECURITY-390 unclaimed
XSS vulnerability in Stapler debug mode
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1999025 BR2018-0000-041325 SECURITY-932 unclaimed
TraceTronic ECU-TEST Plugin globally and unconditionally disables SSL/TLS certificate validation
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1999026 BR2018-0000-041326 SECURITY-994 unclaimed
CSRF vulnerability and missing permission checks in TraceTronic ECU-TEST Plugin allowed server-side request forgery
Credited as Viktor Gazdag
CVE-2018-1999027 BR2018-0000-041327 SECURITY-1009 unclaimed
CSRF vulnerability and missing permission checks in SaltStack Plugin allowed capturing credentials
Credited as Oleg Nenashev
CVE-2018-1999028 BR2018-0000-041328 SECURITY-1021 unclaimed
CSRF vulnerability and missing permission checks in Accurev Plugin allowed capturing credentials
Credited as Oleg Nenashev
CVE-2018-1999029 BR2018-0000-041329 SECURITY-1001 unclaimed
Stored Cross-Site Scripting Vulnerability in Shelve Project Plugin
Credited as Oleg Nenashev
CVE-2018-1999030 BR2018-0000-041330 SECURITY-1022 unclaimed
CSRF vulnerability and missing permission checks in Maven Artifact ChoiceListProvider (Nexus) Plugin allowed capturing credentials
Credited as Oleg Nenashev
CVE-2018-1999031 BR2018-0000-041331 SECURITY-847 unclaimed
meliora-testlab Plugin stored API Key in plain text
Credited as Viktor Gazdag
CVE-2018-1999032 BR2018-0000-041332 SECURITY-995 unclaimed
CSRF vulnerability and missing permission checks in Agiletestware Pangolin Connector for TestRail Plugin allowed overriding plugin configuration
Credited as Viktor Gazdag
CVE-2018-1999033 BR2018-0000-041333 SECURITY-1039 unclaimed
Anchore Container Image Scanner Plugin stored password in plain text
Credited as Viktor Gazdag
CVE-2018-1999034 BR2018-0000-041334 SECURITY-933 unclaimed
Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1999035 BR2018-0000-041335 SECURITY-935 unclaimed
Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1999036 BR2018-0000-041336 SECURITY-704 unclaimed
SSH Agent Plugin could reveal SSH key passphrase when used inside pipeline
Credited as Jan Hollevoet
CVE-2018-1999038 BR2018-0000-041337 SECURITY-975 unclaimed
CSRF vulnerability and missing permission checks in Publish Over CIFS Plugin
Credited as Viktor Gazdag
CVE-2018-1999039 BR2018-0000-041338 SECURITY-982 unclaimed
CSRF vulnerability and missing permission checks in Confluence Publisher Plugin
Credited as Viktor Gazdag
CVE-2018-1999040 BR2018-0000-041339 SECURITY-1016 unclaimed
CSRF vulnerability and missing permission checks in Kubernetes Plugin allowed capturing credentials
Credited as Oleg Nenashev
CVE-2018-1999041 BR2018-0000-041340 SECURITY-840 unclaimed
Tinfoil Security Plugin stored API Secret Key in plain text
Credited as Viktor Gazdag