Jenkins Project
Page 14 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10419 | Medium | 5.5 | 2019-09-25 | Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-10418 | Critical | 9.9 | 2019-09-25 | Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, b… |
CVE-2019-10417 | Critical | 9.9 | 2019-09-25 | Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, b… |
CVE-2019-10416 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be v… |
CVE-2019-10415 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they c… |
CVE-2019-10414 | Medium | 6.5 | 2019-09-25 | Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users… |
CVE-2019-10413 | Medium | 6.5 | 2019-09-25 | Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by u… |
CVE-2019-10412 | High | 7.5 | 2019-09-25 | Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resu… |
CVE-2019-10411 | High | 7.5 | 2019-09-25 | Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-10410 | Medium | 5.4 | 2019-09-25 | Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to defin… |
CVE-2019-10409 | Medium | 4.3 | 2019-09-25 | A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation… |
CVE-2019-10408 | Medium | 4.3 | 2019-09-25 | A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templat… |
CVE-2019-10407 | Medium | 6.5 | 2019-09-25 | Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contribute… |
CVE-2019-10406 | Medium | 4.8 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS… |
CVE-2019-10405 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting ano… |
CVE-2019-10404 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability… |
CVE-2019-10403 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability… |
CVE-2019-10402 | Medium | 5.4 | 2019-09-25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability… |
CVE-2019-10401 | Medium | 5.4 | 2019-09-25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a store… |
CVE-2019-10400 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressi… |
CVE-2019-10399 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in incremen… |
CVE-2019-10398 | Medium | 5.5 | 2019-09-12 | Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10397 | Low | 3.1 | 2019-09-12 | Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiall… |
CVE-2019-10396 | Medium | 5.4 | 2019-09-12 | Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able t… |
CVE-2019-10395 | Medium | 5.4 | 2019-09-12 | Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.14… |
CVE-2019-10394 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left… |
CVE-2019-10393 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed at… |
CVE-2019-10392 | High | 8.8 | 2019-09-12 | Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting… |
CVE-2019-10391 | Medium | 6.5 | 2019-08-28 | Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potential… |
CVE-2019-10390 | High | 8.8 | 2019-08-28 | A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP… |
CVE-2019-10384 | High | 8.8 | 2019-08-28 | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did… |
CVE-2019-10383 | Medium | 4.8 | 2019-08-28 | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to confi… |
CVE-2019-10389 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connecti… |
CVE-2019-10388 | Medium | 4.3 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate… |
CVE-2019-10387 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read acces… |
CVE-2019-10386 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Ov… |
CVE-2019-10385 | Medium | 6.5 | 2019-08-07 | Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Ext… |
CVE-2019-10382 | Medium | 6.5 | 2019-08-07 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10381 | High | 7.5 | 2019-08-07 | Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10380 | High | 8.8 | 2019-08-07 | Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execut… |
CVE-2019-10379 | Medium | 6.5 | 2019-08-07 | Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where… |
CVE-2019-10378 | Medium | 5.3 | 2019-08-07 | Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-10377 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins. |
CVE-2019-10376 | Medium | 6.1 | 2019-08-07 | A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into… |
CVE-2019-10375 | Medium | 6.5 | 2019-08-07 | An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the content… |
CVE-2019-10374 | Medium | 5.4 | 2019-08-07 | A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields ren… |
CVE-2019-10373 | Medium | 5.4 | 2019-08-07 | A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to… |
CVE-2019-10372 | Medium | 6.1 | 2019-08-07 | An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL… |
CVE-2019-10371 | High | 7.5 | 2019-08-07 | A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersona… |
CVE-2019-10370 | Medium | 6.5 | 2019-08-07 | Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting… |
CVE-2019-10369 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTes… |
CVE-2019-10368 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.Desc… |
CVE-2019-10367 | Medium | 5.5 | 2019-08-07 | Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be… |
CVE-2019-10366 | Medium | 6.5 | 2019-07-31 | Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by user… |
CVE-2019-10365 | Medium | 4.3 | 2019-07-31 | Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could… |
CVE-2019-10364 | Medium | 5.5 | 2019-07-31 | Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. |
CVE-2019-10363 | Medium | 4.9 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. |
CVE-2019-10362 | Medium | 5.4 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, all… |
CVE-2019-10361 | Medium | 5.5 | 2019-07-31 | Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the mas… |
CVE-2019-10360 | Medium | 5.4 | 2019-07-31 | A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the… |
CVE-2019-10359 | Medium | 6.3 | 2019-07-31 | A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perfo… |
CVE-2019-10358 | Medium | 6.5 | 2019-07-31 | Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the bu… |
CVE-2019-10357 | Medium | 4.3 | 2019-07-31 | A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited inform… |
CVE-2019-10356 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to ex… |
CVE-2019-10355 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-10344 | Medium | 4.3 | 2019-07-31 | Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access t… |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-10354 | Medium | 4.3 | 2019-07-17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, by… |
CVE-2019-10353 | High | 7.5 | 2019-07-17 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. |
CVE-2019-10352 | Medium | 6.5 | 2019-07-17 | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attacke… |
CVE-2019-10351 | High | 8.8 | 2019-07-11 | Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read per… |
CVE-2019-10350 | High | 8.8 | 2019-07-11 | Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-10349 | Medium | 5.4 | 2019-07-11 | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to i… |
CVE-2019-10348 | High | 8.8 | 2019-07-11 | Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10347 | High | 8.8 | 2019-07-11 | Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system. |
CVE-2019-10346 | Medium | 6.1 | 2019-07-11 | A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScri… |
CVE-2019-10342 | Medium | 4.3 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enu… |
CVE-2019-10341 | Medium | 6.5 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to co… |
CVE-2019-10340 | High | 8.8 | 2019-07-11 | A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/R… |
CVE-2019-10339 | High | 8.8 | 2019-06-11 | A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read acce… |
CVE-2019-10338 | High | 8.8 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to… |
CVE-2019-10337 | High | 7.5 | 2019-06-11 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file fo… |
CVE-2019-10336 | Medium | 6.1 | 2019-06-11 | A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlo… |
CVE-2019-10335 | Medium | 5.4 | 2019-06-11 | A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the… |
CVE-2019-10334 | Medium | 6.5 | 2019-06-11 | Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used… |
CVE-2019-10333 | Medium | 4.3 | 2019-06-11 | Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain informati… |
CVE-2019-10332 | Medium | 4.3 | 2019-06-11 | A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect… |
CVE-2019-10331 | Medium | 4.3 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to a… |
CVE-2019-10330 | High | 7.5 | 2019-05-31 | Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles eve… |
CVE-2019-10329 | High | 8.8 | 2019-05-31 | Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-10328 | Critical | 9.9 | 2019-05-31 | Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypas… |
CVE-2019-10327 | High | 8.1 | 2019-05-31 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary direc… |
CVE-2019-10326 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds. |
CVE-2019-10325 | Medium | 5.4 | 2019-05-31 | A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScr… |
CVE-2019-10324 | Medium | 6.5 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenRe… |
CVE-2019-10323 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access t… |
CVE-2019-10322 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Rea… |
CVE-2019-10321 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users… |
CVE-2019-10320 | Medium | 4.3 | 2019-05-21 | Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins ma… |