Yaroslav Afenkin

The Jenkins Redpen - Pipeline Reporter for Jira Plugin does not properly validate file paths within the workspace directory during artifact uploads to Jira. This allows individuals with Item/Configure permissions to access files located on the Jenkins controller's workspace directory. The issue arises from insufficient path validation, potentially enabling unauthorized file retrieval.

The issue is related to an incorrect permission check in the Jenkins GitLab Plugin. This allows attackers with global Item/Configure permission, but lacking Item/Configure permission on any particular job, to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins. These credential IDs can be used as part of an attack to capture the credentials using another vulnerability.

The issue potentially allows users who were formerly granted certain permissions to access functionality they are no longer entitled to, because the plugin does not verify that the configured permissions are enabled. This typically involves optional permissions.

The global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections does not take effect until Jenkins is restarted when switching from disabled validation to enabled validation.

The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not sanitize iceScrum project URLs on build views. Attackers who can configure jobs may exploit this.

The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token, which could lead to unauthorized access to confidential information.

A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. This endpoint also does not require POST requests, further contributing to the vulnerability.

A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. The connection test HTTP endpoint is vulnerable, and it does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

The issue results in a stored cross-site scripting (XSS) vulnerability because the Trac website URL on the build page is not escaped. This vulnerability is exploitable by attackers with Item/Configure permission.

The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It potentially allows a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This could allow attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It may allow a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the GitHub project URL on the build page is not properly escaped when showing changes. Attackers with Item/Configure permission can exploit this vulnerability.

The issue is related to the lack of escaping of the `caption` constructor parameter value of `ExpandableDetailsNote`, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control this parameter, potentially allowing them to manage files in workspaces. The `ExpandableDetailsNote` feature allows annotating build log content with additional information that can be revealed when interacted with.

The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Build Failure Analyzer Plugin does not escape Failure Cause names in build logs. This makes it exploitable by attackers who can create or update Failure Causes.

The issue is related to a non-constant time comparison function used when checking whether the provided and expected CSRF protection nonce are equal. This potentially allows attackers to use statistical methods to obtain a valid nonce.

The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage, to access functionality they are no longer entitled to. This is because the plugin does not verify that these permissions are enabled.

The issue concerns the Jenkins Pipeline Maven Integration Plugin, which does not properly mask usernames of credentials specified in custom Maven settings in Pipeline build logs when "Treat username as secret" is checked. This affects the security of credentials by potentially exposing them in the build logs.

The issue results in users with EDIT permissions being granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. This occurs because the plugin does not verify that the permissions it grants are enabled.

A cross-site request forgery (CSRF) vulnerability allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.