Search for packages
| purl | pkg:rpm/redhat/jenkins-2-plugins@4.10.1680703106-1?arch=el8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5bu5-5b6n-nuft
Aliases: CVE-2023-24422 GHSA-76qj-9gwh-pvv3 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. | There are no reported fixed by versions. |
|
VCID-j986-mtma-b3bw
Aliases: CVE-2022-42889 GHSA-599f-7c49-w659 |
Arbitrary code execution in Apache Commons Text Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:56:43.724339+00:00 | RedHat Importer | Affected by | VCID-j986-mtma-b3bw | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-42889.json | 38.0.0 |
| 2026-04-01T13:55:39.262317+00:00 | RedHat Importer | Affected by | VCID-5bu5-5b6n-nuft | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-24422.json | 38.0.0 |