BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Releases - September 2018

jenkins-2018-09 Sep 1, 2018 Source: Vendor

Jenkins security advisories for September 2018: 12 CVEs, 7 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

12 lines
All 12 CVEs 12 Additional recognition 0 Unclaimed only
Showing 1–12 of 12
CVE-2018-1000411 BR2018-0000-041346 SECURITY-1101 unclaimed
CSRF vulnerability in JUnit Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000412 BR2018-0000-041347 SECURITY-1029 unclaimed
CSRF vulnerability and missing permission checks in Jira Plugin allowed capturing credentials
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2018-1000413 BR2018-0000-041348 SECURITY-1080 unclaimed
Stored XSS vulnerability in Config File Provider Plugin
Credited as Zhouyuan Yang of Fortinet's FortiGuard Labs
CVE-2018-1000414 BR2018-0000-041349 SECURITY-938 unclaimed
CSRF vulnerability in Config File Provider Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000415 BR2018-0000-041350 SECURITY-130 unclaimed
Stored XSS vulnerability in Rebuild Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000416 BR2018-0000-041351 SECURITY-1130 unclaimed
Reflected XSS vulnerability in Job Config History Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000417 BR2018-0000-041352 SECURITY-1125 unclaimed
CSRF vulnerability in Email Extension Template Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000422 BR2018-0000-041353 SECURITY-1067 unclaimed
Server-side request forgery vulnerability in Crowd 2 Integration Plugin
Credited as Viktor Gazdag
CVE-2018-1000423 BR2018-0000-041354 SECURITY-1068 unclaimed
Crowd 2 Integration Plugin stored credentials in plain text
Credited as Viktor Gazdag
CVE-2018-1000424 BR2018-0000-041355 SECURITY-265 unclaimed
Artifactory Plugin stored old directly entered credentials unencrypted on disk
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000425 BR2018-0000-041356 SECURITY-1163 unclaimed
SonarQube Scanner Plugin stored server authentication token in plain text
Credited as The CJE team from ABN-AMRO
CVE-2018-1000426 BR2018-0000-041357 SECURITY-1122 unclaimed
Stored XSS vulnerability in Git Changelog Plugin
Credited as Daniel Beck, CloudBees, Inc.