CVE Vulnerability Catalog

Vulnerability in Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain permissions configured for a privileged group.

Vulnerability in Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution.

Vulnerability in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files on the Jenkins controller's file system.

Jenkins SAML Plugin version 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

Jenkins ThinBackup Plugin version 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for dashboard links based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie. This allows attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization. This allows attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

In Stapler versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (inclusive, except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.447 through 2.579 and LTS 2.452.1 through 2.568.2, an HTTP endpoint serving dynamically generated JavaScript embeds the user's CSRF token (crumb) as a string literal. This allows attackers controlling a page on the same site as Jenkins to obtain a valid crumb for the target user's session and perform actions on their behalf.

In Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, timestamp), resulting in a stored XSS vulnerability exploitable by attackers controlling agent processes.

In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects instantiated via form data binding to those compatible with the expected field type. This allows attackers with Overall/Read permission to instantiate types related to configuration for which that field type was not intended.

In Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files (such as global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.

A vulnerability in the XML module of NGINX JavaScript (njs) affects the namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger an out-of-bounds write past the end of a heap allocation when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and QuickJS (qjs) engines are affected.

A flaw in util-linux: Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

A vulnerability in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

A vulnerability in NGINX Ingress Controller where the configuration generator does not sanitize user-controllable fields from Ingress annotations. An authenticated attacker with permission to create or modify these annotations can inject arbitrary NGINX configuration directives.

A vulnerability in BIG-IP where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).