Vulnerabilities > Jenkins > Fitnesse

DATE CVE VULNERABILITY TITLE RISK
2020-04-07 CVE-2020-2175 Cross-site Scripting vulnerability in Jenkins Fitnesse
Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.
network
low complexity
jenkins CWE-79
5.4
5.4
2020-02-12 CVE-2020-2120 XXE vulnerability in Jenkins Fitnesse
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
network
low complexity
jenkins CWE-611
8.8
8.8