Jenkins Project
Page 13 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2093 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content t… |
CVE-2020-2092 | High | 8.8 | 2020-01-15 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Config… |
CVE-2020-2091 | High | 8.1 | 2020-01-15 | A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2020-2090 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AW… |
CVE-2019-16576 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2019-16575 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2019-16574 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2019-16573 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL… |
CVE-2019-16572 | Medium | 5.5 | 2019-12-17 | Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-16571 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2019-16570 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server. |
CVE-2019-16569 | Medium | 4.3 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using atta… |
CVE-2019-16568 | Medium | 5.3 | 2019-12-17 | Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as i… |
CVE-2019-16567 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credent… |
CVE-2019-16566 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2019-16565 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2019-16564 | Medium | 5.4 | 2019-12-17 | Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by a… |
CVE-2019-16563 | Medium | 5.4 | 2019-12-17 | Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability… |
CVE-2019-16562 | Medium | 5.4 | 2019-12-17 | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable… |
CVE-2019-16561 | High | 7.1 | 2019-12-17 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire… |
CVE-2019-16560 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine wh… |
CVE-2019-16559 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and… |
CVE-2019-16558 | High | 8.2 | 2019-12-17 | Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
CVE-2019-16557 | Medium | 6.5 | 2019-12-17 | Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be v… |
CVE-2019-16556 | Medium | 6.5 | 2019-12-17 | Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-16555 | Medium | 6.5 | 2019-12-17 | A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attac… |
CVE-2019-16554 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a… |
CVE-2019-16553 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationa… |
CVE-2019-16552 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2019-16551 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or… |
CVE-2019-16550 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins… |
CVE-2019-16549 | High | 8.1 | 2019-12-17 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle atta… |
CVE-2019-16548 | High | 8.8 | 2019-11-21 | A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provisi… |
CVE-2019-16547 | Medium | 4.3 | 2019-11-21 | Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to ob… |
CVE-2019-16546 | Medium | 5.9 | 2019-11-21 | Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle a… |
CVE-2019-16545 | Medium | 6.5 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resul… |
CVE-2019-16544 | High | 8.8 | 2019-11-21 | Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2019-16543 | Medium | 5.5 | 2019-11-21 | Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed… |
CVE-2019-16542 | Medium | 6.5 | 2019-11-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can b… |
CVE-2019-16541 | Critical | 9.9 | 2019-11-21 | Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use crede… |
CVE-2019-16540 | Medium | 6.5 | 2019-11-21 | A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the J… |
CVE-2019-16539 | Medium | 6.5 | 2019-11-21 | A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles. |
CVE-2019-16538 | High | 8.8 | 2019-11-21 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed… |
CVE-2019-10476 | High | 7.8 | 2019-10-23 | Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by user… |
CVE-2019-10475 | Medium | 6.1 | 2019-10-23 | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided… |
CVE-2019-10474 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on… |
CVE-2019-10473 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of crede… |
CVE-2019-10472 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using… |
CVE-2019-10471 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-spec… |
CVE-2019-10470 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2019-10469 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-10468 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using… |
CVE-2019-10467 | Medium | 6.5 | 2019-10-23 | Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10466 | High | 8.1 | 2019-10-23 | An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities… |
CVE-2019-10465 | Medium | 4.3 | 2019-10-23 | A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attack… |
CVE-2019-10464 | High | 8.8 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified… |
CVE-2019-10463 | Medium | 6.5 | 2019-10-23 | A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2019-10462 | High | 8.1 | 2019-10-23 | A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect to an attacker-spe… |
CVE-2019-10461 | High | 7.8 | 2019-10-23 | Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2019-10460 | High | 7.8 | 2019-10-23 | Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they coul… |
CVE-2019-10459 | Medium | 6.5 | 2019-10-23 | Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job con… |
CVE-2019-10458 | Critical | 9.9 | 2019-10-16 | Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script… |
CVE-2019-10457 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacke… |
CVE-2019-10456 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified U… |
CVE-2019-10455 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-speci… |
CVE-2019-10454 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credenti… |
CVE-2019-10453 | High | 7.8 | 2019-10-16 | Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10452 | Medium | 4.3 | 2019-10-16 | Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10451 | Medium | 4.3 | 2019-10-16 | Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-10450 | Low | 3.3 | 2019-10-16 | Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10449 | High | 8.8 | 2019-10-16 | Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-10448 | High | 8.8 | 2019-10-16 | Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-10447 | Medium | 4.3 | 2019-10-16 | Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permis… |
CVE-2019-10446 | High | 8.2 | 2019-10-16 | Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10445 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited inform… |
CVE-2019-10444 | Medium | 6.5 | 2019-10-16 | Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. |
CVE-2019-10443 | High | 8.8 | 2019-10-16 | Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with… |
CVE-2019-10442 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2019-10441 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacke… |
CVE-2019-10440 | High | 8.8 | 2019-10-16 | Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-10439 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Ov… |
CVE-2019-10438 | Medium | 6.5 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an att… |
CVE-2019-10437 | High | 8.8 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specifi… |
CVE-2019-10436 | Medium | 6.5 | 2019-10-16 | An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jen… |
CVE-2019-10435 | High | 7.5 | 2019-10-01 | Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. |
CVE-2019-10434 | High | 7.5 | 2019-10-01 | Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their expos… |
CVE-2019-10433 | Low | 3.3 | 2019-10-01 | Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10432 | Medium | 5.4 | 2019-10-01 | Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting… |
CVE-2019-10431 | Critical | 9.9 | 2019-10-01 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allo… |
CVE-2019-10430 | Medium | 5.5 | 2019-09-25 | Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they… |
CVE-2019-10429 | Medium | 5.5 | 2019-09-25 | Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access… |
CVE-2019-10428 | High | 7.5 | 2019-09-25 | Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, pote… |
CVE-2019-10427 | Medium | 5.3 | 2019-09-25 | Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-10426 | Medium | 5.5 | 2019-09-25 | Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10425 | Medium | 6.5 | 2019-09-25 | Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10424 | Medium | 5.5 | 2019-09-25 | Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10423 | Medium | 5.5 | 2019-09-25 | Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10422 | Medium | 6.5 | 2019-09-25 | Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10421 | Medium | 4.3 | 2019-09-25 | Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w… |
CVE-2019-10420 | Medium | 5.5 | 2019-09-25 | Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |