Jenkins Project
Page 11 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2292 | Medium | 5.4 | 2020-10-08 | Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2291 | Low | 3.3 | 2020-10-08 | Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it ca… |
CVE-2020-2290 | Medium | 5.4 | 2020-10-08 | Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored… |
CVE-2020-2289 | Medium | 5.4 | 2020-10-08 | Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2020-2288 | Medium | 5.3 | 2020-10-08 | In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would… |
CVE-2020-2287 | Medium | 5.3 | 2020-10-08 | Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for… |
CVE-2020-2286 | High | 8.8 | 2020-10-08 | Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting i… |
CVE-2020-2285 | Medium | 4.3 | 2020-09-23 | A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of c… |
CVE-2020-2284 | High | 7.1 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2283 | Medium | 5.4 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl… |
CVE-2020-2282 | Medium | 4.3 | 2020-09-23 | Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to confi… |
CVE-2020-2281 | Medium | 5.4 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and rese… |
CVE-2020-2280 | High | 8.8 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. |
CVE-2020-2279 | Critical | 9.9 | 2020-09-23 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide craft… |
CVE-2020-2278 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any… |
CVE-2020-2277 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller. |
CVE-2020-2276 | High | 8.8 | 2020-09-16 | Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to… |
CVE-2020-2275 | Medium | 6.5 | 2020-09-16 | Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing at… |
CVE-2020-2274 | Medium | 5.5 | 2020-09-16 | Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2020-2273 | Medium | 4.3 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2020-2272 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2020-2271 | Medium | 5.4 | 2020-09-16 | Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabil… |
CVE-2020-2270 | Medium | 5.4 | 2020-09-16 | Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vuln… |
CVE-2020-2269 | Medium | 5.4 | 2020-09-16 | Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2268 | High | 8.8 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary f… |
CVE-2020-2267 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbit… |
CVE-2020-2266 | Medium | 5.4 | 2020-09-16 | Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) v… |
CVE-2020-2265 | Medium | 5.4 | 2020-09-16 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scriptin… |
CVE-2020-2264 | Medium | 5.4 | 2020-09-16 | Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2263 | Medium | 5.4 | 2020-09-16 | Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2020-2262 | Medium | 5.4 | 2020-09-16 | Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2261 | High | 8.8 | 2020-09-16 | Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary comman… |
CVE-2020-2260 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP U… |
CVE-2020-2259 | Medium | 5.4 | 2020-09-16 | Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2258 | Medium | 4.3 | 2020-09-16 | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall… |
CVE-2020-2257 | Medium | 5.4 | 2020-09-16 | Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2020-2256 | Medium | 5.4 | 2020-09-16 | Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stor… |
CVE-2020-2255 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2020-2254 | Medium | 6.5 | 2020-09-16 | Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create perm… |
CVE-2020-2253 | Medium | 4.8 | 2020-09-16 | Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2252 | Medium | 4.8 | 2020-09-16 | Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2251 | Medium | 4.3 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms… |
CVE-2020-2250 | Medium | 6.5 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-2248 | Medium | 6.1 | 2020-09-01 | Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. |
CVE-2020-2247 | Medium | 6.5 | 2020-09-01 | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2246 | Medium | 5.4 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2020-2245 | High | 7.1 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2244 | Medium | 5.4 | 2020-09-01 | Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS)… |
CVE-2020-2243 | Medium | 5.4 | 2020-09-01 | Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2020-2242 | Medium | 6.5 | 2020-09-01 | A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified… |
CVE-2020-2241 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database serv… |
CVE-2020-2240 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts. |
CVE-2020-2239 | Medium | 4.3 | 2020-09-01 | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2020-2238 | Medium | 5.4 | 2020-09-01 | Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scri… |
CVE-2020-2237 | Medium | 4.3 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous gi… |
CVE-2020-2236 | Medium | 5.4 | 2020-08-12 | Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2235 | Medium | 6.5 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-spe… |
CVE-2020-2234 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-speci… |
CVE-2020-2233 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of… |
CVE-2020-2232 | High | 7.5 | 2020-08-12 | Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potential… |
CVE-2020-2231 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in… |
CVE-2020-2230 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2020-2229 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2020-2228 | High | 8.8 | 2020-07-15 | Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. |
CVE-2020-2227 | Medium | 5.4 | 2020-07-15 | Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerab… |
CVE-2020-2226 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scriptin… |
CVE-2020-2225 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in… |
CVE-2020-2224 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in… |
CVE-2020-2223 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console pa… |
CVE-2020-2222 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-sit… |
CVE-2020-2221 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-… |
CVE-2020-2220 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vuln… |
CVE-2020-2219 | Medium | 5.4 | 2020-07-02 | Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scri… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2020-2217 | Medium | 6.1 | 2020-07-02 | Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint… |
CVE-2020-2216 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2020-2215 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2020-2214 | Medium | 5.4 | 2020-07-02 | Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived art… |
CVE-2020-2213 | Medium | 4.3 | 2020-07-02 | Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins maste… |
CVE-2020-2212 | Medium | 4.3 | 2020-07-02 | Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be vie… |
CVE-2020-2211 | High | 8.8 | 2020-07-02 | Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultin… |
CVE-2020-2210 | Medium | 4.3 | 2020-07-02 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2209 | Medium | 4.3 | 2020-07-02 | Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by use… |
CVE-2020-2208 | Medium | 4.3 | 2020-07-02 | Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Exte… |
CVE-2020-2207 | Medium | 6.1 | 2020-07-02 | Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site sc… |
CVE-2020-2206 | Medium | 6.1 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site… |
CVE-2020-2205 | Medium | 4.8 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site script… |
CVE-2020-2204 | Medium | 5.4 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally confi… |
CVE-2020-2203 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify… |
CVE-2020-2202 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2020-2201 | Medium | 5.4 | 2020-07-02 | Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site… |
CVE-2020-2200 | High | 8.8 | 2020-06-03 | Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulti… |
CVE-2020-2199 | Medium | 6.1 | 2020-06-03 | Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting i… |
CVE-2020-2198 | Medium | 6.5 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data… |
CVE-2020-2197 | Medium | 4.3 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurat… |
CVE-2020-2196 | High | 8.0 | 2020-06-03 | Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided b… |
CVE-2020-2195 | Medium | 5.4 | 2020-06-03 | Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability… |
CVE-2020-2194 | Medium | 5.4 | 2020-06-03 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vu… |
CVE-2020-2193 | Medium | 5.4 | 2020-06-03 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerab… |