CVE Vulnerability Catalog

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to improper neutralization issues, classified as CWE-707.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to protection mechanism failure issues, classified as CWE-693.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to insufficient control flow management issues, classified as CWE-691.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to incorrect calculation issues, classified as CWE-682.

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings.

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters, allowing arbitrary command execution with the privileges of the build user.

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier. Attackers able to control build environment variable values can execute arbitrary commands on the agent running the build.

Vulnerability in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, enabling attackers to configure a custom SVG icon with inline JavaScript, resulting in stored XSS.

Vulnerability in Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain permissions configured for a privileged group.

Vulnerability in Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

Vulnerability in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.

Jenkins SAML Plugin version 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

Jenkins ThinBackup Plugin version 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for dashboard links based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie. This allows attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization. This allows attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

In Stapler versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (inclusive, except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.447 through 2.579 and LTS 2.452.1 through 2.568.2, an HTTP endpoint serving dynamically generated JavaScript embeds the user's CSRF token (crumb) as a string literal. This allows attackers controlling a page on the same site as Jenkins to obtain a valid crumb for the target user's session and perform actions on their behalf.

In Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, timestamp), resulting in a stored XSS vulnerability exploitable by attackers controlling agent processes.

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects instantiated via form data binding to those compatible with the expected field type. This allows attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.