mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-28 10:08:24 +00:00
Code Issues Releases Activity

Document Jenkins Security Advisory 2013-02-16

Browse Source
This commit is contained in:
Li-Wen Hsu 2013-02-17 10:28:54 +00:00
parent 2abd4e66e6
commit e43326a3a9
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=312408
1 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
security/vuxml/vuln.xml
View File

@ -51,6 +51,47 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="7fe5b84a-78eb-11e2-8441-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.501</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16">
<p>This advisory announces multiple security vulnerabilities that
were found in Jenkins core.</p>
<ol>
<li>One of the vulnerabilities allows cross-site request
forgery (CSRF) attacks on Jenkins master, which causes an user
to make unwanted actions on Jenkins. Another vulnerability
enables cross-site scripting (XSS) attacks, which has the similar
consequence. Another vulnerability allowed an attacker to bypass
the CSRF protection mechanism in place, thereby mounting more CSRF
attackes. These attacks allow an attacker without direct access to
Jenkins to mount an attack.</li>
<li>In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.</li>
<li>And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16</url>
</references>
<dates>
<discovery>2013-02-16</discovery>
<entry>2013-02-17</entry>
</dates>
</vuln>
<vuln vid="f7809d9e-6af0-11e2-8e32-080027d768d3">
<topic>poweradmin -- multiple XSS vulnerabilities</topic>
<affects>