This advisory announces security vulnerabilities that were found in Jenkins core and several plugins.
The first vulnerability in Jenkins core allows unprivileged users to insert data into the Jenkins controller, which can lead to remote code execution. For this vulnerability to be exploited, the attacker must have an HTTP access to a Jenkins controller, and he must have a read access to Jenkins.
The second vulnerability in Jenkins core is a cross-site scripting vulnerability. This allows an attacker to craft an URL that points to Jenkins, and if a legitimate user clicks this link, and the attacker will be able to hijack the user session.
The third vulnerability is a cross-site scripting vulnerability in the Violations plugin
The fourth vulnerability is a cross-site scripting vulnerability in the Continuous Integration Game plugin
Several of these vulnerabilities were discovered by Avram Marius Gabriel.
The first vulnerability in the core is rated as critical, as it allows malicious users to execute arbitrary code on the server. The other three XSS vulnerabilities are rated as high, as they allow malicious users to escalate privileges.