Jenkins Project
Page 10 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20614 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenki… |
CVE-2022-20613 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins… |
CVE-2022-20612 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parame… |
CVE-2021-43578 | High | 8.1 | 2021-11-12 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its i… |
CVE-2021-43577 | High | 7.1 | 2021-11-12 | Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-43576 | Medium | 6.5 | 2021-11-12 | Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read… |
CVE-2021-21701 | Medium | 6.5 | 2021-11-12 | Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21700 | Medium | 5.4 | 2021-11-12 | Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site… |
CVE-2021-21699 | Medium | 5.4 | 2021-11-12 | Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stor… |
CVE-2021-21698 | High | 7.5 | 2021-11-04 | Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. |
CVE-2021-21697 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restr… |
CVE-2021-21696 | Critical | 9.8 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePa… |
CVE-2021-21695 | High | 8.8 | 2021-11-04 | FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 an… |
CVE-2021-21694 | Critical | 9.8 | 2021-11-04 | FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and e… |
CVE-2021-21693 | Critical | 9.8 | 2021-11-04 | When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2… |
CVE-2021-21692 | Critical | 9.8 | 2021-11-04 | FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission… |
CVE-2021-21691 | Critical | 9.8 | 2021-11-04 | Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21690 | Critical | 9.8 | 2021-11-04 | Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303… |
CVE-2021-21689 | Critical | 9.1 | 2021-11-04 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. |
CVE-2021-21688 | High | 7.5 | 2021-11-04 | The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allo… |
CVE-2021-21687 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FileP… |
CVE-2021-21686 | High | 8.1 | 2021-11-04 | File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing opera… |
CVE-2021-21685 | Critical | 9.1 | 2021-11-04 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. |
CVE-2021-21684 | Medium | 6.1 | 2021-10-06 | Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause… |
CVE-2021-21683 | Medium | 6.5 | 2021-10-06 | The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal… |
CVE-2021-21682 | Medium | 4.3 | 2021-10-06 | Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configurat… |
CVE-2021-21681 | Medium | 5.5 | 2021-08-31 | Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by… |
CVE-2021-21680 | High | 7.1 | 2021-08-31 | Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. |
CVE-2021-21679 | High | 8.8 | 2021-08-31 | Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21678 | High | 8.8 | 2021-08-31 | Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. |
CVE-2021-21677 | High | 8.8 | 2021-08-31 | Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulti… |
CVE-2021-21676 | Medium | 4.3 | 2021-06-30 | Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to se… |
CVE-2021-21675 | Medium | 6.5 | 2021-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administ… |
CVE-2021-21674 | Medium | 4.3 | 2021-06-30 | A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending reques… |
CVE-2021-21673 | Medium | 6.1 | 2021-06-30 | Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform p… |
CVE-2021-21672 | Medium | 4.3 | 2021-06-30 | Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21671 | High | 7.5 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. |
CVE-2021-21670 | Medium | 4.3 | 2021-06-30 | Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even… |
CVE-2021-21669 | Critical | 9.8 | 2021-06-18 | Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21668 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacker… |
CVE-2021-21667 | Medium | 5.4 | 2021-06-16 | Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2021-21666 | Medium | 6.1 | 2021-06-10 | Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-sit… |
CVE-2021-21665 | High | 8.8 | 2021-06-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2021-21664 | Medium | 6.5 | 2021-06-10 | An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacke… |
CVE-2021-21663 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2021-21662 | Medium | 4.3 | 2021-06-10 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID o… |
CVE-2021-21661 | Medium | 4.3 | 2021-06-10 | Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission… |
CVE-2021-21660 | Medium | 5.4 | 2021-05-25 | Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2021-21659 | High | 8.1 | 2021-05-25 | Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21658 | Critical | 9.1 | 2021-05-25 | Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21657 | High | 8.8 | 2021-05-25 | Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21656 | High | 7.1 | 2021-05-11 | Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21655 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server… |
CVE-2021-21654 | Medium | 4.3 | 2021-05-11 | Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect… |
CVE-2021-21653 | Medium | 4.3 | 2021-05-11 | Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission… |
CVE-2021-21652 | High | 7.1 | 2021-05-11 | A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacke… |
CVE-2021-21651 | Medium | 4.3 | 2021-05-11 | Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obta… |
CVE-2021-21650 | Medium | 4.3 | 2021-05-11 | Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers wi… |
CVE-2021-21649 | Medium | 5.4 | 2021-05-11 | Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2021-21648 | Medium | 6.1 | 2021-05-11 | Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting… |
CVE-2021-21647 | Medium | 4.3 | 2021-04-21 | Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedul… |
CVE-2021-21646 | High | 8.8 | 2021-04-21 | Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configu… |
CVE-2021-21645 | Medium | 4.3 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to e… |
CVE-2021-21644 | Medium | 5.4 | 2021-04-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corre… |
CVE-2021-21643 | Medium | 6.5 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints, allowing attackers with global Jo… |
CVE-2021-21642 | High | 8.1 | 2021-04-21 | Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2021-21641 | Medium | 4.3 | 2021-04-07 | A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. |
CVE-2021-21640 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create p… |
CVE-2021-21639 | Medium | 4.3 | 2021-04-07 | Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API e… |
CVE-2021-21638 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2021-21637 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2021-21636 | Medium | 4.3 | 2021-03-30 | A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2021-21635 | Medium | 5.4 | 2021-03-30 | Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site script… |
CVE-2021-21634 | Medium | 6.5 | 2021-03-30 | Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller wher… |
CVE-2021-21633 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2021-21632 | Medium | 6.5 | 2021-03-30 | A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2021-21631 | Medium | 4.3 | 2021-03-30 | Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and k… |
CVE-2021-21630 | Medium | 5.4 | 2021-03-30 | Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS)… |
CVE-2021-21629 | High | 8.8 | 2021-03-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-spe… |
CVE-2021-21628 | Medium | 5.4 | 2021-03-30 | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnera… |
CVE-2021-21627 | High | 8.8 | 2021-03-18 | A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier allows attackers to stop hypervisor domains. |
CVE-2021-21626 | Medium | 4.3 | 2021-03-18 | Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with… |
CVE-2021-21625 | Medium | 4.3 | 2021-03-18 | Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Ov… |
CVE-2021-21624 | Medium | 4.3 | 2021-03-18 | An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to… |
CVE-2021-21623 | Medium | 6.5 | 2021-03-18 | An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with Item/Read permission on nested items to a… |
CVE-2021-21622 | Medium | 5.4 | 2021-02-24 | Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XS… |
CVE-2021-21621 | Medium | 5.3 | 2021-02-24 | Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" inform… |
CVE-2021-21620 | Medium | 4.3 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims. |
CVE-2021-21619 | Medium | 5.4 | 2021-02-24 | Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by at… |
CVE-2021-21618 | Medium | 5.4 | 2021-02-24 | Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site script… |
CVE-2021-21617 | High | 8.8 | 2021-02-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply different slice configurat… |
CVE-2021-21616 | Medium | 4.6 | 2021-02-24 | Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability expl… |
CVE-2021-21615 | Medium | 5.3 | 2021-01-26 | Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use… |
CVE-2021-21614 | Medium | 5.5 | 2021-01-13 | Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be v… |
CVE-2021-21613 | Medium | 6.1 | 2021-01-13 | Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attac… |
CVE-2021-21612 | Medium | 5.5 | 2021-01-13 | Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can… |
CVE-2021-21611 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-… |
CVE-2021-21610 | Medium | 6.1 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query pa… |
CVE-2021-21609 | Medium | 5.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without O… |
CVE-2021-21608 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exp… |