FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-21695
https://www.jenkins.io…
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, infor…
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-21658
https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2340
http://w…
A remote code execution vulnerability exists when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. This CVE ID is unique from CVE-2021-26701.
References
https://nvd.nist.gov/vuln/detail/CVE-…
.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-1721
https://portal.msrc.micro…
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-21605
https://www.jen…
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
References
https://nvd.nist.gov/vuln/detail/CVE-2020-36191
https://github.com/jupyte…
A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.
References
https://nvd.nist.gov/vul…
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) …
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-2320
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-1856
http://www.openwall.com/lists/oss…
