Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 45

Export CSV
CVE-2019-1003024

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform
CVE-2019-1003005

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 19.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift
CVE-2019-1003000

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 98.4% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform
CVE-2018-1000865

jenkins-plugin-script-security: Sandbox Bypass in finalize methods

A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform
CVE-2017-1000505

jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663)

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins
Products
Script Security