Jenkins Project
Page 12 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2230 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2020-2229 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2020-2228 | High | 8.8 | 2020-07-15 | Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. |
CVE-2020-2227 | Medium | 5.4 | 2020-07-15 | Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerab… |
CVE-2020-2226 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scriptin… |
CVE-2020-2225 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in… |
CVE-2020-2224 | Medium | 5.4 | 2020-07-15 | Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in… |
CVE-2020-2223 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console pa… |
CVE-2020-2222 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-sit… |
CVE-2020-2221 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-… |
CVE-2020-2220 | Medium | 5.4 | 2020-07-15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vuln… |
CVE-2020-2219 | Medium | 5.4 | 2020-07-02 | Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scri… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2020-2217 | Medium | 6.1 | 2020-07-02 | Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint… |
CVE-2020-2216 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2020-2215 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2020-2214 | Medium | 5.4 | 2020-07-02 | Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived art… |
CVE-2020-2213 | Medium | 4.3 | 2020-07-02 | Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins maste… |
CVE-2020-2212 | Medium | 4.3 | 2020-07-02 | Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be vie… |
CVE-2020-2211 | High | 8.8 | 2020-07-02 | Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultin… |
CVE-2020-2210 | Medium | 4.3 | 2020-07-02 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2209 | Medium | 4.3 | 2020-07-02 | Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by use… |
CVE-2020-2208 | Medium | 4.3 | 2020-07-02 | Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Exte… |
CVE-2020-2207 | Medium | 6.1 | 2020-07-02 | Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site sc… |
CVE-2020-2206 | Medium | 6.1 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site… |
CVE-2020-2205 | Medium | 4.8 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site script… |
CVE-2020-2204 | Medium | 5.4 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally confi… |
CVE-2020-2203 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify… |
CVE-2020-2202 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2020-2201 | Medium | 5.4 | 2020-07-02 | Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site… |
CVE-2020-2200 | High | 8.8 | 2020-06-03 | Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulti… |
CVE-2020-2199 | Medium | 6.1 | 2020-06-03 | Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting i… |
CVE-2020-2198 | Medium | 6.5 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data… |
CVE-2020-2197 | Medium | 4.3 | 2020-06-03 | Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurat… |
CVE-2020-2196 | High | 8.0 | 2020-06-03 | Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided b… |
CVE-2020-2195 | Medium | 5.4 | 2020-06-03 | Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability… |
CVE-2020-2194 | Medium | 5.4 | 2020-06-03 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vu… |
CVE-2020-2193 | Medium | 5.4 | 2020-06-03 | Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerab… |
CVE-2020-2192 | Medium | 6.5 | 2020-06-03 | A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent lab… |
CVE-2020-2191 | Medium | 4.3 | 2020-06-03 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels. |
CVE-2020-2190 | Medium | 5.4 | 2020-06-03 | Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulti… |
CVE-2020-2189 | High | 8.8 | 2020-05-06 | Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote co… |
CVE-2020-2188 | Medium | 4.3 | 2020-05-06 | A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credenti… |
CVE-2020-2187 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-mid… |
CVE-2020-2186 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. |
CVE-2020-2185 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. |
CVE-2020-2184 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker… |
CVE-2020-2183 | Medium | 6.5 | 2020-05-06 | Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to… |
CVE-2020-2182 | Medium | 4.3 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. |
CVE-2020-2181 | Medium | 6.5 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build step… |
CVE-2020-2180 | High | 8.8 | 2020-04-16 | Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2020-2179 | High | 8.8 | 2020-04-16 | Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execu… |
CVE-2020-2178 | High | 7.1 | 2020-04-16 | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2177 | Medium | 4.3 | 2020-04-16 | Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extende… |
CVE-2020-2176 | Medium | 5.4 | 2020-04-07 | Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cr… |
CVE-2020-2175 | Medium | 5.4 | 2020-04-07 | Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scri… |
CVE-2020-2174 | Medium | 6.1 | 2020-04-07 | Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-sit… |
CVE-2020-2173 | Medium | 5.4 | 2020-04-07 | Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS… |
CVE-2020-2172 | Medium | 6.5 | 2020-04-07 | Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2171 | High | 8.8 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2170 | Medium | 5.4 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting in a stored XSS vuln… |
CVE-2020-2169 | Medium | 6.1 | 2020-03-25 | A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting… |
CVE-2020-2168 | High | 8.8 | 2020-03-25 | Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rem… |
CVE-2020-2167 | High | 8.8 | 2020-03-25 | Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote… |
CVE-2020-2166 | High | 8.8 | 2020-03-25 | Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote c… |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2020-2164 | Medium | 6.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it… |
CVE-2020-2163 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability explo… |
CVE-2020-2162 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in… |
CVE-2020-2161 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job conf… |
CVE-2020-2160 | High | 8.8 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassi… |
CVE-2020-2159 | High | 8.8 | 2020-03-09 | Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user a… |
CVE-2020-2158 | High | 8.8 | 2020-03-09 | Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio… |
CVE-2020-2157 | Medium | 4.3 | 2020-03-09 | Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in the… |
CVE-2020-2156 | Medium | 4.3 | 2020-03-09 | Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their e… |
CVE-2020-2155 | Medium | 5.3 | 2020-03-09 | Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentiall… |
CVE-2020-2154 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file s… |
CVE-2020-2153 | Medium | 4.3 | 2020-03-09 | Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposu… |
CVE-2020-2152 | Medium | 6.1 | 2020-03-09 | Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflec… |
CVE-2020-2151 | Medium | 5.3 | 2020-03-09 | Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resul… |
CVE-2020-2150 | Medium | 5.3 | 2020-03-09 | Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potential… |
CVE-2020-2149 | Medium | 5.3 | 2020-03-09 | Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2148 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2020-2147 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attack… |
CVE-2020-2146 | High | 7.4 | 2020-03-09 | Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. |
CVE-2020-2145 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system. |
CVE-2020-2144 | High | 7.1 | 2020-03-09 | Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2143 | Medium | 5.3 | 2020-03-09 | Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resultin… |
CVE-2020-2142 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds. |
CVE-2020-2141 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce. |
CVE-2020-2140 | Medium | 6.1 | 2020-03-09 | Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site sc… |
CVE-2020-2139 | Medium | 6.5 | 2020-03-09 | An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwr… |
CVE-2020-2138 | High | 7.1 | 2020-03-09 | Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2137 | Medium | 4.8 | 2020-03-09 | Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers… |
CVE-2020-2136 | Medium | 5.4 | 2020-03-09 | Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cr… |
CVE-2020-2135 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterc… |
CVE-2020-2134 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies. |
CVE-2012-0785 | High | 7.5 | 2020-02-24 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400… |
CVE-2020-2133 | Medium | 6.5 | 2020-02-12 | Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extend… |
CVE-2020-2132 | Medium | 6.5 | 2020-02-12 | Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed… |