Jenkins Project
Page 11 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21607 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request cra… |
CVE-2021-21606 | Medium | 4.3 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an att… |
CVE-2021-21605 | High | 8.0 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global… |
CVE-2021-21604 | High | 8.0 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old D… |
CVE-2021-21603 | Medium | 5.4 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability. |
CVE-2021-21602 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following sym… |
CVE-2020-2324 | High | 7.5 | 2020-12-03 | Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2323 | Medium | 5.3 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access t… |
CVE-2020-2322 | High | 7.5 | 2020-12-03 | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to ge… |
CVE-2020-2321 | High | 8.1 | 2020-12-03 | A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project. |
CVE-2020-2320 | Critical | 9.8 | 2020-12-03 | Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. |
CVE-2020-2319 | Medium | 6.5 | 2020-11-04 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can b… |
CVE-2020-2318 | Medium | 6.5 | 2020-11-04 | Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2317 | Medium | 5.4 | 2020-11-04 | Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2316 | Medium | 5.4 | 2020-11-04 | Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2315 | Medium | 6.5 | 2020-11-04 | Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2314 | Medium | 5.5 | 2020-11-04 | Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by… |
CVE-2020-2313 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cred… |
CVE-2020-2312 | Medium | 6.5 | 2020-11-04 | Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. |
CVE-2020-2311 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS c… |
CVE-2020-2310 | Medium | 4.3 | 2020-11-04 | Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2020-2309 | Medium | 4.3 | 2020-11-04 | A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2020-2308 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. |
CVE-2020-2307 | Medium | 4.3 | 2020-11-04 | Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. |
CVE-2020-2306 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured M… |
CVE-2020-2305 | Medium | 6.5 | 2020-11-04 | Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2304 | Medium | 6.5 | 2020-11-04 | Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2303 | Medium | 4.3 | 2020-11-04 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting… |
CVE-2020-2302 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check… |
CVE-2020-2301 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is sti… |
CVE-2020-2300 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenki… |
CVE-2020-2299 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. |
CVE-2020-2298 | Medium | 6.5 | 2020-10-08 | Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2297 | Low | 3.3 | 2020-10-08 | Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be v… |
CVE-2020-2296 | Medium | 4.3 | 2020-10-08 | A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects. |
CVE-2020-2295 | Medium | 6.5 | 2020-10-08 | A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout… |
CVE-2020-2294 | Medium | 6.5 | 2020-10-08 | Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permi… |
CVE-2020-2293 | Medium | 6.5 | 2020-10-08 | Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. |
CVE-2020-2292 | Medium | 5.4 | 2020-10-08 | Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2291 | Low | 3.3 | 2020-10-08 | Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it ca… |
CVE-2020-2290 | Medium | 5.4 | 2020-10-08 | Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored… |
CVE-2020-2289 | Medium | 5.4 | 2020-10-08 | Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2020-2288 | Medium | 5.3 | 2020-10-08 | In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would… |
CVE-2020-2287 | Medium | 5.3 | 2020-10-08 | Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for… |
CVE-2020-2286 | High | 8.8 | 2020-10-08 | Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting i… |
CVE-2020-2285 | Medium | 4.3 | 2020-09-23 | A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of c… |
CVE-2020-2284 | High | 7.1 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2283 | Medium | 5.4 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl… |
CVE-2020-2282 | Medium | 4.3 | 2020-09-23 | Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to confi… |
CVE-2020-2281 | Medium | 5.4 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and rese… |
CVE-2020-2280 | High | 8.8 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. |
CVE-2020-2279 | Critical | 9.9 | 2020-09-23 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide craft… |
CVE-2020-2278 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any… |
CVE-2020-2277 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller. |
CVE-2020-2276 | High | 8.8 | 2020-09-16 | Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to… |
CVE-2020-2275 | Medium | 6.5 | 2020-09-16 | Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing at… |
CVE-2020-2274 | Medium | 5.5 | 2020-09-16 | Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2020-2273 | Medium | 4.3 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2020-2272 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2020-2271 | Medium | 5.4 | 2020-09-16 | Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabil… |
CVE-2020-2270 | Medium | 5.4 | 2020-09-16 | Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vuln… |
CVE-2020-2269 | Medium | 5.4 | 2020-09-16 | Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2268 | High | 8.8 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary f… |
CVE-2020-2267 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbit… |
CVE-2020-2266 | Medium | 5.4 | 2020-09-16 | Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) v… |
CVE-2020-2265 | Medium | 5.4 | 2020-09-16 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scriptin… |
CVE-2020-2264 | Medium | 5.4 | 2020-09-16 | Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2263 | Medium | 5.4 | 2020-09-16 | Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2020-2262 | Medium | 5.4 | 2020-09-16 | Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2261 | High | 8.8 | 2020-09-16 | Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary comman… |
CVE-2020-2260 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP U… |
CVE-2020-2259 | Medium | 5.4 | 2020-09-16 | Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2258 | Medium | 4.3 | 2020-09-16 | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall… |
CVE-2020-2257 | Medium | 5.4 | 2020-09-16 | Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2020-2256 | Medium | 5.4 | 2020-09-16 | Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stor… |
CVE-2020-2255 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2020-2254 | Medium | 6.5 | 2020-09-16 | Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create perm… |
CVE-2020-2253 | Medium | 4.8 | 2020-09-16 | Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2252 | Medium | 4.8 | 2020-09-16 | Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2251 | Medium | 4.3 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms… |
CVE-2020-2250 | Medium | 6.5 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-2248 | Medium | 6.1 | 2020-09-01 | Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. |
CVE-2020-2247 | Medium | 6.5 | 2020-09-01 | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2246 | Medium | 5.4 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2020-2245 | High | 7.1 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2244 | Medium | 5.4 | 2020-09-01 | Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS)… |
CVE-2020-2243 | Medium | 5.4 | 2020-09-01 | Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2020-2242 | Medium | 6.5 | 2020-09-01 | A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified… |
CVE-2020-2241 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database serv… |
CVE-2020-2240 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts. |
CVE-2020-2239 | Medium | 4.3 | 2020-09-01 | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2020-2238 | Medium | 5.4 | 2020-09-01 | Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scri… |
CVE-2020-2237 | Medium | 4.3 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous gi… |
CVE-2020-2236 | Medium | 5.4 | 2020-08-12 | Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2235 | Medium | 6.5 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-spe… |
CVE-2020-2234 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-speci… |
CVE-2020-2233 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of… |
CVE-2020-2232 | High | 7.5 | 2020-08-12 | Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potential… |
CVE-2020-2231 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in… |