The Jenkins CLI sent different error responses for commands with
view and agent arguments depending on the existence of the specified
views or agents to unauthorized users. This allowed attackers to
determine whether views or agents with specified names exist.
The Jenkins CLI now returns the same error messages to unauthorized
users independent of the existence of specified view or agent
names
Some JavaScript confirmation dialogs included the item name in an
unsafe manner, resulting in a possible cross-site scripting
vulnerability exploitable by users with permission to create or
configure items.
JavaScript confirmation dialogs that include the item name now
properly escape it, so it can be safely displayed.