Vulnerabilities > Jenkins > Liquibase Runner > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-09-23 CVE-2020-2285 Missing Authorization vulnerability in Jenkins Liquibase Runner
A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
network
low complexity
jenkins CWE-862
4.3
2020-09-23 CVE-2020-2283 Cross-site Scripting vulnerability in Jenkins Liquibase Runner
Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control changeset files evaluated by the plugin.
network
low complexity
jenkins CWE-79
5.4