Vulnerabilities (CVE)

Filtered by vendor Jenkins Subscribe
Filtered by product Dotci
Total 3 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-41237 1 Jenkins 1 Dotci 2022-09-22 N/A 9.8 CRITICAL
Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2022-41239 1 Jenkins 1 Dotci 2022-09-22 N/A 5.4 MEDIUM
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2022-41238 1 Jenkins 1 Dotci 2022-09-22 N/A 9.8 CRITICAL
A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.