Show filters
33 Total Results
Displaying 21-30 of 33
Sort by:
Attacker Value
Unknown
CVE-2019-10399
Disclosure Date: September 12, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.
0
Attacker Value
Unknown
CVE-2019-10356
Disclosure Date: July 31, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
0
Attacker Value
Unknown
CVE-2019-10355
Disclosure Date: July 31, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
0
Attacker Value
Unknown
CVE-2019-1003040
Disclosure Date: March 28, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
0
Attacker Value
Unknown
CVE-2019-1003029
Disclosure Date: March 08, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
0
Attacker Value
Unknown
CVE-2019-1003024
Disclosure Date: February 20, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
0
Attacker Value
Unknown
CVE-2019-1003005
Disclosure Date: February 06, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
0
Attacker Value
Unknown
CVE-2019-1003000
Disclosure Date: January 22, 2019 (last updated October 26, 2023)
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
0
Attacker Value
Unknown
CVE-2018-1000865
Disclosure Date: December 10, 2018 (last updated November 27, 2024)
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
0
Attacker Value
Unknown
CVE-2017-1000505
Disclosure Date: January 25, 2018 (last updated November 26, 2024)
In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.
0
