Icescrum

icescrum

Vendor: Jenkins • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-28160 1Jenkins 1Icescrum Jun 17, 2026 Mar 6, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2019-10443 1Jenkins 1Icescrum Jun 17, 2026 Oct 16, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file syste...Show more Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.Show less
CVE-2019-10442 1Jenkins 1Icescrum Jun 17, 2026 Oct 16, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2019-10441 1Jenkins 1Icescrum Jun 17, 2026 Oct 16, 2019 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacker-specified credentials.