Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-21658
https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2340
http://w…
A remote code execution vulnerability exists when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. This CVE ID is unique from CVE-2021-26701.
References
https://nvd.nist.gov/vuln/detail/CVE-…
.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-1721
https://portal.msrc.micro…
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-21605
https://www.jen…
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
References
https://nvd.nist.gov/vuln/detail/CVE-2020-36191
https://github.com/jupyte…
A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.
References
https://nvd.nist.gov/vul…
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) …
Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-2320
https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-1856
http://www.openwall.com/lists/oss…
Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode.
References
https://nvd.nist.gov/vuln/…
Jenkins Active Directory Plugin prior to 2.20 does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server.
References
https:…
