Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:00:44 +0000 fkie_cve-2019-10395 https://vulnerability.circl.lu/vuln/fkie_cve-2019-10395 <p>Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.</p> <p>Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2019-10395 GHSA-88qj-3q6h-8m5q — Jenkins Build Environment Plugin vulnerable to Cross-site Scripting https://vulnerability.circl.lu/vuln/ghsa-88qj-3q6h-8m5q <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:build-environment</p> <p>Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.</p> <p>Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.</p> <p>Build Environment Plugin now escapes all variables displayed in its views.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.plugins:build-environment</p> <p>Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.</p> <p>Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.</p> <p>Build Environment Plugin now escapes all variables displayed in its views.</p> https://vulnerability.circl.lu/vuln/ghsa-88qj-3q6h-8m5q gsd-2019-10395 https://vulnerability.circl.lu/vuln/gsd-2019-10395 gsd-2019-10395 https://vulnerability.circl.lu/vuln/gsd-2019-10395