jenkins-plugin-favorite: Missing permission check in Favorite Plugin allows anyone to change favorites for any other user

Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites

jenkins-plugin-favorite: CSRF vulnerability in Favorite Plugin allows changing another user’s favorites

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification

A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from another user's favorite views tab bar.

jenkins-2-plugins/favorite: Favorite Plugin XSS Vulnerability

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.