CVE-2019-10336

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.

• CWE-79

• http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108747
• https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108747
• https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory

Published

Jun 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10330Jenkins Gitea Plugin 1.1.1 and earlier did not implement tru…7.5
• CVE-2019-10331A cross-site request forgery vulnerability in Jenkins Electr…
• CVE-2019-10332A missing permission check in Jenkins ElectricFlow Plugin 1.…4.3
• CVE-2019-10333Missing permission checks in Jenkins ElectricFlow Plugin 1.1…4.3
• CVE-2019-10334Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/T…
• CVE-2019-10335A stored cross site scripting vulnerability in Jenkins Elect…
• CVE-2019-10337An XML external entities (XXE) vulnerability in Jenkins Toke…
• CVE-2019-10338A cross-site request forgery vulnerability in Jenkins JX Res…
• CVE-2019-10339A missing permission check in Jenkins JX Resources Plugin 1.…8.8
• CVE-2019-1034A remote code execution vulnerability exists in Microsoft Wo…
• CVE-2019-10340A cross-site request forgery vulnerability in Jenkins Docker…8.8
• CVE-2019-10341A missing permission check in Jenkins Docker Plugin 1.1.6 an…6.5