Jenkins Project
Page 15 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10357 | Medium | 4.3 | 2019-07-31 | A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited inform… |
CVE-2019-10356 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to ex… |
CVE-2019-10355 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-10344 | Medium | 4.3 | 2019-07-31 | Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access t… |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-10354 | Medium | 4.3 | 2019-07-17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, by… |
CVE-2019-10353 | High | 7.5 | 2019-07-17 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. |
CVE-2019-10352 | Medium | 6.5 | 2019-07-17 | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attacke… |
CVE-2019-10351 | High | 8.8 | 2019-07-11 | Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read per… |
CVE-2019-10350 | High | 8.8 | 2019-07-11 | Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-10349 | Medium | 5.4 | 2019-07-11 | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to i… |
CVE-2019-10348 | High | 8.8 | 2019-07-11 | Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10347 | High | 8.8 | 2019-07-11 | Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system. |
CVE-2019-10346 | Medium | 6.1 | 2019-07-11 | A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScri… |
CVE-2019-10342 | Medium | 4.3 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enu… |
CVE-2019-10341 | Medium | 6.5 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to co… |
CVE-2019-10340 | High | 8.8 | 2019-07-11 | A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/R… |
CVE-2019-10339 | High | 8.8 | 2019-06-11 | A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read acce… |
CVE-2019-10338 | High | 8.8 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to… |
CVE-2019-10337 | High | 7.5 | 2019-06-11 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file fo… |
CVE-2019-10336 | Medium | 6.1 | 2019-06-11 | A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlo… |
CVE-2019-10335 | Medium | 5.4 | 2019-06-11 | A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the… |
CVE-2019-10334 | Medium | 6.5 | 2019-06-11 | Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used… |
CVE-2019-10333 | Medium | 4.3 | 2019-06-11 | Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain informati… |
CVE-2019-10332 | Medium | 4.3 | 2019-06-11 | A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect… |
CVE-2019-10331 | Medium | 4.3 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to a… |
CVE-2019-10330 | High | 7.5 | 2019-05-31 | Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles eve… |
CVE-2019-10329 | High | 8.8 | 2019-05-31 | Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-10328 | Critical | 9.9 | 2019-05-31 | Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypas… |
CVE-2019-10327 | High | 8.1 | 2019-05-31 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary direc… |
CVE-2019-10326 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds. |
CVE-2019-10325 | Medium | 5.4 | 2019-05-31 | A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScr… |
CVE-2019-10324 | Medium | 6.5 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenRe… |
CVE-2019-10323 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access t… |
CVE-2019-10322 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Rea… |
CVE-2019-10321 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users… |
CVE-2019-10320 | Medium | 4.3 | 2019-05-21 | Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins ma… |
CVE-2019-10319 | Medium | 4.3 | 2019-05-21 | A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Over… |
CVE-2019-10318 | High | 8.8 | 2019-04-30 | Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could… |
CVE-2019-10317 | Medium | 5.9 | 2019-04-30 | Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10316 | High | 8.8 | 2019-04-30 | Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be vi… |
CVE-2019-10315 | High | 8.8 | 2019-04-30 | Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF. |
CVE-2019-10314 | Medium | 5.9 | 2019-04-30 | Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10313 | High | 8.8 | 2019-04-30 | Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10312 | Medium | 4.3 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems… |
CVE-2019-10311 | High | 8.8 | 2019-04-30 | A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form va… |
CVE-2019-10310 | High | 8.8 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerCo… |
CVE-2019-10309 | Critical | 9.3 | 2019-04-30 | Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing… |
CVE-2019-10308 | Medium | 6.5 | 2019-04-30 | A missing permission check in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handler method allowed… |
CVE-2019-10307 | Medium | 6.5 | 2019-04-30 | A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationView#doSave form handle… |
CVE-2019-10306 | Critical | 9.9 | 2019-04-18 | A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code… |
CVE-2019-10305 | Medium | 6.5 | 2019-04-18 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Over… |
CVE-2019-10304 | Medium | 6.5 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows att… |
CVE-2019-10303 | High | 8.8 | 2019-04-18 | Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they… |
CVE-2019-10302 | High | 8.8 | 2019-04-18 | Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by use… |
CVE-2019-10301 | High | 8.8 | 2019-04-18 | A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers… |
CVE-2019-10300 | High | 8.0 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method al… |
CVE-2019-1003050 | Medium | 5.4 | 2019-04-10 | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulti… |
CVE-2019-1003049 | High | 8.1 | 2019-04-10 | Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and… |
CVE-2019-10299 | High | 8.8 | 2019-04-04 | Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-10298 | High | 8.8 | 2019-04-04 | Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the… |
CVE-2019-10297 | High | 8.8 | 2019-04-04 | Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10296 | High | 8.8 | 2019-04-04 | Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-10295 | High | 8.8 | 2019-04-04 | Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-10294 | High | 8.8 | 2019-04-04 | Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10293 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to… |
CVE-2019-10292 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a c… |
CVE-2019-10291 | High | 8.8 | 2019-04-04 | Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be… |
CVE-2019-10290 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method all… |
CVE-2019-10289 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form valid… |
CVE-2019-10288 | High | 8.8 | 2019-04-04 | Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10287 | High | 8.8 | 2019-04-04 | Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10286 | High | 8.8 | 2019-04-04 | Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-10285 | High | 8.8 | 2019-04-04 | Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10284 | High | 8.8 | 2019-04-04 | Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10283 | High | 8.8 | 2019-04-04 | Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10282 | High | 8.8 | 2019-04-04 | Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10281 | High | 8.8 | 2019-04-04 | Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be v… |
CVE-2019-10280 | High | 8.8 | 2019-04-04 | Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10279 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overa… |
CVE-2019-10278 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows atta… |
CVE-2019-10277 | High | 8.8 | 2019-04-04 | Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permi… |
CVE-2019-1003099 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overal… |
CVE-2019-1003098 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attac… |
CVE-2019-1003097 | Medium | 6.5 | 2019-04-04 | Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-1003096 | Medium | 6.5 | 2019-04-04 | Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003095 | Medium | 6.5 | 2019-04-04 | Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003094 | Medium | 6.5 | 2019-04-04 | Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003093 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read… |
CVE-2019-1003092 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to… |
CVE-2019-1003091 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Ove… |
CVE-2019-1003090 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows at… |
CVE-2019-1003089 | Medium | 6.5 | 2019-04-04 | Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-1003088 | Medium | 6.5 | 2019-04-04 | Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-1003087 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attacke… |
CVE-2019-1003086 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation metho… |
CVE-2019-1003085 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers wi… |
CVE-2019-1003084 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method all… |
CVE-2019-1003083 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read perm… |