Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output. This results in a reflected cross-site scripting (XSS) vulnerability. VncRecorder Plugin 1.35 escapes the parameter value in the output.
Recommended action: Upgrade to 1.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms. This results in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators. VncRecorder Plugin 1.35 escapes the tool path.
Recommended action: Upgrade to 1.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.