Threats affecting pkg:maven/org.jenkins-ci/main/jenkins-core

A vulnerability in Jenkins versions 2.567 and earlier (including LTS 2.555.2 and earlier) allows users with Overall/Read permission to access other users' configured timezone settings and enumerate the names of views in other users' "My Views". This is due to missing permission checks. The issue has a medium severity with a CVSS score of 4.3.

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.