jenkins is vulnerable to cross-site scripting (XSS). The vulnerability exists as it is possible to inject arbitrary web script.
access.redhat.com/errata/RHBA-2014:1630
access.redhat.com/errata/RHSA-2016:0070
access.redhat.com/security/cve/CVE-2013-5573
access.redhat.com/security/cve/CVE-2013-6372
access.redhat.com/security/cve/CVE-2013-7330
access.redhat.com/security/cve/CVE-2014-2059
access.redhat.com/security/cve/CVE-2014-2060
access.redhat.com/security/cve/CVE-2014-2061
access.redhat.com/security/cve/CVE-2014-2062
access.redhat.com/security/cve/CVE-2014-2063
access.redhat.com/security/cve/CVE-2014-2064
access.redhat.com/security/cve/CVE-2014-2065
access.redhat.com/security/cve/CVE-2014-2066
access.redhat.com/security/cve/CVE-2014-2067
access.redhat.com/security/cve/CVE-2014-2068
access.redhat.com/security/cve/CVE-2014-3661
access.redhat.com/security/cve/CVE-2014-3662
access.redhat.com/security/cve/CVE-2014-3663
access.redhat.com/security/cve/CVE-2014-3664
access.redhat.com/security/cve/CVE-2014-3665
access.redhat.com/security/cve/CVE-2014-3666
access.redhat.com/security/cve/CVE-2014-3667
access.redhat.com/security/cve/CVE-2014-3678
access.redhat.com/security/cve/CVE-2014-3681
bugzilla.redhat.com/show_bug.cgi?id=1127667
bugzilla.redhat.com/show_bug.cgi?id=1147766
exchange.xforce.ibmcloud.com/vulnerabilities/96975
rhn.redhat.com/errata/RHBA-2014-1630.html
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01