Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-21640.json"