Jenkins Project
Page 15 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10319 | Medium | 4.3 | 2019-05-21 | A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Over… |
CVE-2019-10318 | High | 8.8 | 2019-04-30 | Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could… |
CVE-2019-10317 | Medium | 5.9 | 2019-04-30 | Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10316 | High | 8.8 | 2019-04-30 | Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be vi… |
CVE-2019-10315 | High | 8.8 | 2019-04-30 | Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF. |
CVE-2019-10314 | Medium | 5.9 | 2019-04-30 | Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10313 | High | 8.8 | 2019-04-30 | Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10312 | Medium | 4.3 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems… |
CVE-2019-10311 | High | 8.8 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form va… |
CVE-2019-10310 | High | 8.8 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerCo… |
CVE-2019-10309 | Critical | 9.3 | 2019-04-30 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing… |
CVE-2019-10308 | Medium | 6.5 | 2019-04-30 | A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed… |
CVE-2019-10307 | Medium | 6.5 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handle… |
CVE-2019-10306 | Critical | 9.9 | 2019-04-18 | A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code… |
CVE-2019-10305 | Medium | 6.5 | 2019-04-18 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Over… |
CVE-2019-10304 | Medium | 6.5 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows att… |
CVE-2019-10303 | High | 8.8 | 2019-04-18 | Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they… |
CVE-2019-10302 | High | 8.8 | 2019-04-18 | Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by use… |
CVE-2019-10301 | High | 8.8 | 2019-04-18 | A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers… |
CVE-2019-10300 | High | 8.0 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method al… |
CVE-2019-1003050 | Medium | 5.4 | 2019-04-10 | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulti… |
CVE-2019-1003049 | High | 8.1 | 2019-04-10 | Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and… |
CVE-2019-10299 | High | 8.8 | 2019-04-04 | Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-10298 | High | 8.8 | 2019-04-04 | Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the… |
CVE-2019-10297 | High | 8.8 | 2019-04-04 | Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10296 | High | 8.8 | 2019-04-04 | Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-10295 | High | 8.8 | 2019-04-04 | Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-10294 | High | 8.8 | 2019-04-04 | Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10293 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to… |
CVE-2019-10292 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a c… |
CVE-2019-10291 | High | 8.8 | 2019-04-04 | Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be… |
CVE-2019-10290 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method all… |
CVE-2019-10289 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form valid… |
CVE-2019-10288 | High | 8.8 | 2019-04-04 | Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10287 | High | 8.8 | 2019-04-04 | Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10286 | High | 8.8 | 2019-04-04 | Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-10285 | High | 8.8 | 2019-04-04 | Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10284 | High | 8.8 | 2019-04-04 | Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10283 | High | 8.8 | 2019-04-04 | Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10282 | High | 8.8 | 2019-04-04 | Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10281 | High | 8.8 | 2019-04-04 | Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be v… |
CVE-2019-10280 | High | 8.8 | 2019-04-04 | Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10279 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overa… |
CVE-2019-10278 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows atta… |
CVE-2019-10277 | High | 8.8 | 2019-04-04 | Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permi… |
CVE-2019-1003099 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overal… |
CVE-2019-1003098 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attac… |
CVE-2019-1003097 | Medium | 6.5 | 2019-04-04 | Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-1003096 | Medium | 6.5 | 2019-04-04 | Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003095 | Medium | 6.5 | 2019-04-04 | Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003094 | Medium | 6.5 | 2019-04-04 | Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003093 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read… |
CVE-2019-1003092 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to… |
CVE-2019-1003091 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Ove… |
CVE-2019-1003090 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows at… |
CVE-2019-1003089 | Medium | 6.5 | 2019-04-04 | Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-1003088 | Medium | 6.5 | 2019-04-04 | Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-1003087 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attacke… |
CVE-2019-1003086 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation metho… |
CVE-2019-1003085 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers wi… |
CVE-2019-1003084 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method all… |
CVE-2019-1003083 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read perm… |
CVE-2019-1003082 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to ini… |
CVE-2019-1003081 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows… |
CVE-2019-1003080 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validati… |
CVE-2019-1003079 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attacker… |
CVE-2019-1003078 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method… |
CVE-2019-1003077 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attacke… |
CVE-2019-1003076 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation metho… |
CVE-2019-1003075 | High | 8.8 | 2019-04-04 | Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003074 | High | 8.8 | 2019-04-04 | Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003073 | High | 8.8 | 2019-04-04 | Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2019-1003072 | High | 8.8 | 2019-04-04 | Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-1003071 | High | 8.8 | 2019-04-04 | Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003070 | High | 8.8 | 2019-04-04 | Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003069 | High | 8.8 | 2019-04-04 | Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-1003068 | High | 8.8 | 2019-04-04 | Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with E… |
CVE-2019-1003067 | High | 8.8 | 2019-04-04 | Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-1003066 | High | 8.8 | 2019-04-04 | Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003065 | High | 8.8 | 2019-04-04 | Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003064 | High | 8.8 | 2019-04-04 | Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003063 | High | 8.8 | 2019-04-04 | Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003062 | High | 8.8 | 2019-04-04 | Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by… |
CVE-2019-1003061 | High | 8.8 | 2019-04-04 | Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit… |
CVE-2019-1003060 | High | 8.8 | 2019-04-04 | Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with… |
CVE-2019-1003059 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission… |
CVE-2019-1003058 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate… |
CVE-2019-1003057 | High | 8.8 | 2019-04-04 | Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003056 | High | 8.8 | 2019-04-04 | Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003055 | High | 8.8 | 2019-04-04 | Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003054 | High | 8.8 | 2019-04-04 | Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003053 | High | 8.8 | 2019-04-04 | Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003052 | High | 8.8 | 2019-04-04 | Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed b… |
CVE-2019-1003051 | High | 8.8 | 2019-04-04 | Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the m… |
CVE-2019-1003048 | High | 7.8 | 2019-03-28 | A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted… |
CVE-2019-1003047 | Medium | 6.5 | 2019-03-28 | A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connecti… |
CVE-2019-1003046 | Medium | 6.5 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an atta… |
CVE-2019-1003045 | Medium | 6.5 | 2019-03-28 | A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenki… |
CVE-2019-1003044 | High | 7.1 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2019-1003043 | High | 7.5 | 2019-03-28 | A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |