Jenkins Build Failure Analyzer vulnerabilities
9 vulnerabilities
Known vulnerabilities in Jenkins Build Failure Analyzer, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2016-4988jenkinsbuild_failure_analyzer+1
EPSS score1.23%
Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.CVE-2020-2244jenkins projectjenkins build failure analyzer plugin+2EPSS score0.75%
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.CVE-2019-16554jenkins projectjenkins build failure analyzer plugin+2EPSS score0.82%
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.CVE-2019-16553jenkins projectjenkins build failure analyzer plugin+2EPSS score0.69%
A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.CVE-2019-16555jenkins projectjenkins build failure analyzer plugin+2EPSS score1.08%
A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.CVE-2023-43502jenkins projectjenkins build failure analyzer plugin+2EPSS score0.39%
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.CVE-2023-43500jenkins projectjenkins build failure analyzer plugin+2EPSS score0.47%
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.CVE-2023-43501jenkins projectjenkins build failure analyzer plugin+2EPSS score0.61%
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.CVE-2023-43499jenkins projectjenkins build failure analyzer plugin+2EPSS score0.60%
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.