Jenkins Project
Page 13 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2131 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with… |
CVE-2020-2130 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by use… |
CVE-2020-2129 | Medium | 6.5 | 2020-02-12 | Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by us… |
CVE-2020-2128 | Medium | 4.3 | 2020-02-12 | Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by u… |
CVE-2020-2127 | Medium | 4.3 | 2020-02-12 | Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2020-2126 | Medium | 4.3 | 2020-02-12 | Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with… |
CVE-2020-2125 | Medium | 4.3 | 2020-02-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it ca… |
CVE-2020-2124 | Medium | 4.3 | 2020-02-12 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be… |
CVE-2020-2123 | High | 8.8 | 2020-02-12 | Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio… |
CVE-2020-2122 | Medium | 5.4 | 2020-02-12 | Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting… |
CVE-2020-2121 | High | 8.8 | 2020-02-12 | Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a re… |
CVE-2020-2120 | High | 8.8 | 2020-02-12 | Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2119 | Medium | 5.3 | 2020-02-12 | Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resultin… |
CVE-2020-2118 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to en… |
CVE-2020-2117 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attac… |
CVE-2020-2116 | High | 8.8 | 2020-02-12 | A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified… |
CVE-2020-2115 | High | 8.8 | 2020-02-12 | Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2114 | High | 7.5 | 2020-02-12 | Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially res… |
CVE-2020-2113 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exp… |
CVE-2020-2112 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability ex… |
CVE-2020-2111 | Medium | 5.4 | 2020-02-12 | Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored… |
CVE-2020-2110 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming an… |
CVE-2020-2109 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. |
CVE-2020-2108 | High | 7.6 | 2020-01-29 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configur… |
CVE-2020-2107 | Medium | 4.3 | 2020-01-29 | Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2020-2106 | Medium | 5.4 | 2020-01-29 | Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerabilit… |
CVE-2020-2105 | Medium | 5.4 | 2020-01-29 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. |
CVE-2020-2104 | Medium | 4.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. |
CVE-2020-2103 | Medium | 5.4 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. |
CVE-2020-2102 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. |
CVE-2020-2101 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially a… |
CVE-2020-2100 | Medium | 5.8 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. |
CVE-2020-2099 | High | 8.6 | 2020-01-29 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attac… |
CVE-2020-2098 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account run… |
CVE-2020-2097 | High | 8.8 | 2020-01-15 | Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to exe… |
CVE-2020-2096 | Medium | 6.1 | 2020-01-15 | Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability. |
CVE-2020-2095 | Medium | 4.3 | 2020-01-15 | Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be… |
CVE-2020-2094 | Medium | 4.3 | 2020-01-15 | A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to… |
CVE-2020-2093 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content t… |
CVE-2020-2092 | High | 8.8 | 2020-01-15 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Config… |
CVE-2020-2091 | High | 8.1 | 2020-01-15 | A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2020-2090 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AW… |
CVE-2019-16576 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2019-16575 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2019-16574 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2019-16573 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL… |
CVE-2019-16572 | Medium | 5.5 | 2019-12-17 | Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-16571 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2019-16570 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server. |
CVE-2019-16569 | Medium | 4.3 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using atta… |
CVE-2019-16568 | Medium | 5.3 | 2019-12-17 | Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as i… |
CVE-2019-16567 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credent… |
CVE-2019-16566 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2019-16565 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2019-16564 | Medium | 5.4 | 2019-12-17 | Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by a… |
CVE-2019-16563 | Medium | 5.4 | 2019-12-17 | Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability… |
CVE-2019-16562 | Medium | 5.4 | 2019-12-17 | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable… |
CVE-2019-16561 | High | 7.1 | 2019-12-17 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire… |
CVE-2019-16560 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine wh… |
CVE-2019-16559 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and… |
CVE-2019-16558 | High | 8.2 | 2019-12-17 | Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
CVE-2019-16557 | Medium | 6.5 | 2019-12-17 | Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be v… |
CVE-2019-16556 | Medium | 6.5 | 2019-12-17 | Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-16555 | Medium | 6.5 | 2019-12-17 | A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attac… |
CVE-2019-16554 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a… |
CVE-2019-16553 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationa… |
CVE-2019-16552 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2019-16551 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or… |
CVE-2019-16550 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins… |
CVE-2019-16549 | High | 8.1 | 2019-12-17 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle atta… |
CVE-2019-16548 | High | 8.8 | 2019-11-21 | A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provisi… |
CVE-2019-16547 | Medium | 4.3 | 2019-11-21 | Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to ob… |
CVE-2019-16546 | Medium | 5.9 | 2019-11-21 | Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle a… |
CVE-2019-16545 | Medium | 6.5 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resul… |
CVE-2019-16544 | High | 8.8 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2019-16543 | Medium | 5.5 | 2019-11-21 | Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed… |
CVE-2019-16542 | Medium | 6.5 | 2019-11-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2019-16541 | Critical | 9.9 | 2019-11-21 | Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use crede… |
CVE-2019-16540 | Medium | 6.5 | 2019-11-21 | A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the J… |
CVE-2019-16539 | Medium | 6.5 | 2019-11-21 | A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles. |
CVE-2019-16538 | High | 8.8 | 2019-11-21 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed… |
CVE-2019-10476 | High | 7.8 | 2019-10-23 | Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by user… |
CVE-2019-10475 | Medium | 6.1 | 2019-10-23 | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided… |
CVE-2019-10474 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on… |
CVE-2019-10473 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of crede… |
CVE-2019-10472 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using… |
CVE-2019-10471 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-spec… |
CVE-2019-10470 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2019-10469 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-10468 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using… |
CVE-2019-10467 | Medium | 6.5 | 2019-10-23 | Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10466 | High | 8.1 | 2019-10-23 | An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities… |
CVE-2019-10465 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attack… |
CVE-2019-10464 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified… |
CVE-2019-10463 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2019-10462 | High | 8.1 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-spe… |
CVE-2019-10461 | High | 7.8 | 2019-10-23 | Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2019-10460 | High | 7.8 | 2019-10-23 | Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they coul… |
CVE-2019-10459 | Medium | 6.5 | 2019-10-23 | Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job con… |
CVE-2019-10458 | Critical | 9.9 | 2019-10-16 | Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script… |