Vulnerabilities > Jenkins > Dynamic Extended Choice Parameter
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-07-27 | CVE-2022-36902 | Cross-site Scripting vulnerability in Jenkins Dynamic Extended Choice Parameter 1.0.0/1.0.1 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | 5.4 |
| 2022-06-23 | CVE-2022-34186 | Cross-site Scripting vulnerability in Jenkins Dynamic Extended Choice Parameter 1.0.0/1.0.1 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | 5.4 |
| 2020-02-12 | CVE-2020-2124 | Insufficiently Protected Credentials vulnerability in Jenkins Dynamic Extended Choice Parameter 1.0.0/1.0.1 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. | 4.3 |