BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Releases - June 2018

jenkins-2018-06 Jun 1, 2018 Source: Vendor

Jenkins security advisories for June 2018: 21 CVEs, 7 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

21 lines
All 21 CVEs 21 Additional recognition 0 Unclaimed only
Showing 1–21 of 21
CVE-2018-1000182 BR2018-0000-041297 SECURITY-810 unclaimed
Server-side request forgery vulnerability in Git Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000183 BR2018-0000-041298 SECURITY-804 unclaimed
CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000184 BR2018-0000-041299 SECURITY-799 unclaimed
Server-side request forgery vulnerability in GitHub Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000185 BR2018-0000-041300 SECURITY-806 unclaimed
Server-side request forgery vulnerability in GitHub Branch Source Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000186 BR2018-0000-041301 SECURITY-805 unclaimed
CSRF vulnerability and missing permission checks in GitHub Pull Request Builder Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000187 BR2018-0000-041302 SECURITY-883 unclaimed
Kubernetes Plugin printed sensitive build variables to logs
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1000188 BR2018-0000-041303 SECURITY-809 unclaimed
Server-side request forgery vulnerability in CAS Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000189 BR2018-0000-041304 SECURITY-807 unclaimed
CSRF vulnerability and missing permission checks in AbsInt Astrée Plugin allowed launching programs on the Jenkins controller
Credited as Thomas de Grenier de Latour
CVE-2018-1000190 BR2018-0000-041305 SECURITY-865 unclaimed
CSRF vulnerability and missing permission checks in Black Duck Hub Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000191 BR2018-0000-041306 SECURITY-866 unclaimed
CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000401 BR2018-0000-041307 SECURITY-967 unclaimed
AWS CodePipeline Plugin stored AWS Secret Key in plain text
Credited as Viktor Gazdag
CVE-2018-1000402 BR2018-0000-041308 SECURITY-825 unclaimed
AWS CodeDeploy Plugin persisted possibly sensitive environment variables in job configuration
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000403 BR2018-0000-041309 SECURITY-833 unclaimed
AWS CodeDeploy Plugin stored AWS Secret Key in plain text
Credited as Viktor Gazdag
CVE-2018-1000404 BR2018-0000-041310 SECURITY-834 unclaimed
AWS CodeBuild Plugin stored AWS Secret Key in plain text
Credited as Viktor Gazdag
CVE-2018-1000600 BR2018-0000-041311 SECURITY-915 unclaimed
CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
Credited as Orange Tsai(@orange_8361) from DEVCORE
CVE-2018-1000601 BR2018-0000-041312 SECURITY-440 unclaimed
Arbitrary file read vulnerability in SSH Credentials Plugin with Credentials Binding Plugin
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1000603 BR2018-0000-041313 SECURITY-808 unclaimed
CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000605 BR2018-0000-041314 SECURITY-941 unclaimed
CollabNet Plugin globally and unconditionally disables SSL/TLS certificate validation
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000606 BR2018-0000-041315 SECURITY-819 unclaimed
Server-side request forgery vulnerability in URLTrigger Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000607 BR2018-0000-041316 SECURITY-870 unclaimed
Arbitrary file write vulnerability in Fortify CloudScan Plugin
Credited as Snyk Security Research Team
CVE-2018-1000608 BR2018-0000-041317 SECURITY-950 unclaimed
IBM z/OS Connector Plugin stores password in plain text
Credited as Viktor Gazdag