Vulnerabilities > Jenkins > Active Choices
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-12 | CVE-2021-21699 | Cross-site Scripting vulnerability in Jenkins Active Choices Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | 5.4 |
| 2021-02-24 | CVE-2021-21616 | Cross-site Scripting vulnerability in Jenkins Active Choices Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | 4.6 |
| 2020-10-08 | CVE-2020-2290 | Cross-site Scripting vulnerability in Jenkins Active Choices Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | 5.4 |
| 2020-10-08 | CVE-2020-2289 | Cross-site Scripting vulnerability in Jenkins Active Choices Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | 5.4 |
| 2018-01-26 | CVE-2017-1000386 | Cross-site Scripting vulnerability in Jenkins Active Choices Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. | 3.5 |