Jenkins Project
Page 12 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2192 | Medium | 6.5 | 2020-06-03 | A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent lab… |
CVE-2020-2191 | Medium | 4.3 | 2020-06-03 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels. |
CVE-2020-2190 | Medium | 5.4 | 2020-06-03 | Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulti… |
CVE-2020-2189 | High | 8.8 | 2020-05-06 | Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote co… |
CVE-2020-2188 | Medium | 4.3 | 2020-05-06 | A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credenti… |
CVE-2020-2187 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-mid… |
CVE-2020-2186 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. |
CVE-2020-2185 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. |
CVE-2020-2184 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker… |
CVE-2020-2183 | Medium | 6.5 | 2020-05-06 | Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to… |
CVE-2020-2182 | Medium | 4.3 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. |
CVE-2020-2181 | Medium | 6.5 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build step… |
CVE-2020-2180 | High | 8.8 | 2020-04-16 | Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2020-2179 | High | 8.8 | 2020-04-16 | Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execu… |
CVE-2020-2178 | High | 7.1 | 2020-04-16 | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2177 | Medium | 4.3 | 2020-04-16 | Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extende… |
CVE-2020-2176 | Medium | 5.4 | 2020-04-07 | Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cr… |
CVE-2020-2175 | Medium | 5.4 | 2020-04-07 | Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stored cross-site scri… |
CVE-2020-2174 | Medium | 6.1 | 2020-04-07 | Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a reflected cross-sit… |
CVE-2020-2173 | Medium | 5.4 | 2020-04-07 | Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS… |
CVE-2020-2172 | Medium | 6.5 | 2020-04-07 | Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2171 | High | 8.8 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2170 | Medium | 5.4 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting in a stored XSS vuln… |
CVE-2020-2169 | Medium | 6.1 | 2020-03-25 | A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting… |
CVE-2020-2168 | High | 8.8 | 2020-03-25 | Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rem… |
CVE-2020-2167 | High | 8.8 | 2020-03-25 | Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote… |
CVE-2020-2166 | High | 8.8 | 2020-03-25 | Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote c… |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2020-2164 | Medium | 6.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it… |
CVE-2020-2163 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability explo… |
CVE-2020-2162 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in… |
CVE-2020-2161 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job conf… |
CVE-2020-2160 | High | 8.8 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassi… |
CVE-2020-2159 | High | 8.8 | 2020-03-09 | Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user a… |
CVE-2020-2158 | High | 8.8 | 2020-03-09 | Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio… |
CVE-2020-2157 | Medium | 4.3 | 2020-03-09 | Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in the… |
CVE-2020-2156 | Medium | 4.3 | 2020-03-09 | Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their e… |
CVE-2020-2155 | Medium | 5.3 | 2020-03-09 | Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentiall… |
CVE-2020-2154 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file s… |
CVE-2020-2153 | Medium | 4.3 | 2020-03-09 | Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposu… |
CVE-2020-2152 | Medium | 6.1 | 2020-03-09 | Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflec… |
CVE-2020-2151 | Medium | 5.3 | 2020-03-09 | Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resul… |
CVE-2020-2150 | Medium | 5.3 | 2020-03-09 | Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potential… |
CVE-2020-2149 | Medium | 5.3 | 2020-03-09 | Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2148 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2020-2147 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attack… |
CVE-2020-2146 | High | 7.4 | 2020-03-09 | Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. |
CVE-2020-2145 | Medium | 5.5 | 2020-03-09 | Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system. |
CVE-2020-2144 | High | 7.1 | 2020-03-09 | Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2143 | Medium | 5.3 | 2020-03-09 | Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resultin… |
CVE-2020-2142 | Medium | 4.3 | 2020-03-09 | A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds. |
CVE-2020-2141 | Medium | 4.3 | 2020-03-09 | A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce. |
CVE-2020-2140 | Medium | 6.1 | 2020-03-09 | Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site sc… |
CVE-2020-2139 | Medium | 6.5 | 2020-03-09 | An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwr… |
CVE-2020-2138 | High | 7.1 | 2020-03-09 | Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2137 | Medium | 4.8 | 2020-03-09 | Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers… |
CVE-2020-2136 | Medium | 5.4 | 2020-03-09 | Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cr… |
CVE-2020-2135 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterc… |
CVE-2020-2134 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies. |
CVE-2012-0785 | High | 7.5 | 2020-02-24 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400… |
CVE-2020-2133 | Medium | 6.5 | 2020-02-12 | Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extend… |
CVE-2020-2132 | Medium | 6.5 | 2020-02-12 | Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed… |
CVE-2020-2131 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with… |
CVE-2020-2130 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by use… |
CVE-2020-2129 | Medium | 6.5 | 2020-02-12 | Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by us… |
CVE-2020-2128 | Medium | 4.3 | 2020-02-12 | Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by u… |
CVE-2020-2127 | Medium | 4.3 | 2020-02-12 | Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2020-2126 | Medium | 4.3 | 2020-02-12 | Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with… |
CVE-2020-2125 | Medium | 4.3 | 2020-02-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it ca… |
CVE-2020-2124 | Medium | 4.3 | 2020-02-12 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be… |
CVE-2020-2123 | High | 8.8 | 2020-02-12 | Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio… |
CVE-2020-2122 | Medium | 5.4 | 2020-02-12 | Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting… |
CVE-2020-2121 | High | 8.8 | 2020-02-12 | Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a re… |
CVE-2020-2120 | High | 8.8 | 2020-02-12 | Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2119 | Medium | 5.3 | 2020-02-12 | Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resultin… |
CVE-2020-2118 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to en… |
CVE-2020-2117 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attac… |
CVE-2020-2116 | High | 8.8 | 2020-02-12 | A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified… |
CVE-2020-2115 | High | 8.8 | 2020-02-12 | Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2114 | High | 7.5 | 2020-02-12 | Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially res… |
CVE-2020-2113 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exp… |
CVE-2020-2112 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability ex… |
CVE-2020-2111 | Medium | 5.4 | 2020-02-12 | Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored… |
CVE-2020-2110 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming an… |
CVE-2020-2109 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. |
CVE-2020-2108 | High | 7.6 | 2020-01-29 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configur… |
CVE-2020-2107 | Medium | 4.3 | 2020-01-29 | Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2020-2106 | Medium | 5.4 | 2020-01-29 | Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerabilit… |
CVE-2020-2105 | Medium | 5.4 | 2020-01-29 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. |
CVE-2020-2104 | Medium | 4.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. |
CVE-2020-2103 | Medium | 5.4 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. |
CVE-2020-2102 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. |
CVE-2020-2101 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially a… |
CVE-2020-2100 | Medium | 5.8 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. |
CVE-2020-2099 | High | 8.6 | 2020-01-29 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attac… |
CVE-2020-2098 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account run… |
CVE-2020-2097 | High | 8.8 | 2020-01-15 | Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to exe… |
CVE-2020-2096 | Medium | 6.1 | 2020-01-15 | Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability. |
CVE-2020-2095 | Medium | 4.3 | 2020-01-15 | Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be… |
CVE-2020-2094 | Medium | 4.3 | 2020-01-15 | A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to… |