Jenkins Project
Page 16 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1003082 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to ini… |
CVE-2019-1003081 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows… |
CVE-2019-1003080 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validati… |
CVE-2019-1003079 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attacker… |
CVE-2019-1003078 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method… |
CVE-2019-1003077 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attacke… |
CVE-2019-1003076 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation metho… |
CVE-2019-1003075 | High | 8.8 | 2019-04-04 | Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003074 | High | 8.8 | 2019-04-04 | Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003073 | High | 8.8 | 2019-04-04 | Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2019-1003072 | High | 8.8 | 2019-04-04 | Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-1003071 | High | 8.8 | 2019-04-04 | Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003070 | High | 8.8 | 2019-04-04 | Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003069 | High | 8.8 | 2019-04-04 | Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-1003068 | High | 8.8 | 2019-04-04 | Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with E… |
CVE-2019-1003067 | High | 8.8 | 2019-04-04 | Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-1003066 | High | 8.8 | 2019-04-04 | Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003065 | High | 8.8 | 2019-04-04 | Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003064 | High | 8.8 | 2019-04-04 | Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003063 | High | 8.8 | 2019-04-04 | Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-1003062 | High | 8.8 | 2019-04-04 | Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by… |
CVE-2019-1003061 | High | 8.8 | 2019-04-04 | Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit… |
CVE-2019-1003060 | High | 8.8 | 2019-04-04 | Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with… |
CVE-2019-1003059 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission… |
CVE-2019-1003058 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate… |
CVE-2019-1003057 | High | 8.8 | 2019-04-04 | Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003056 | High | 8.8 | 2019-04-04 | Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003055 | High | 8.8 | 2019-04-04 | Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-1003054 | High | 8.8 | 2019-04-04 | Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended… |
CVE-2019-1003053 | High | 8.8 | 2019-04-04 | Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003052 | High | 8.8 | 2019-04-04 | Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed b… |
CVE-2019-1003051 | High | 8.8 | 2019-04-04 | Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the m… |
CVE-2019-1003048 | High | 7.8 | 2019-03-28 | A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted… |
CVE-2019-1003047 | Medium | 6.5 | 2019-03-28 | A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connecti… |
CVE-2019-1003046 | Medium | 6.5 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an atta… |
CVE-2019-1003045 | Medium | 6.5 | 2019-03-28 | A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenki… |
CVE-2019-1003044 | High | 7.1 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2019-1003043 | High | 7.5 | 2019-03-28 | A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-1003042 | Medium | 5.4 | 2019-03-28 | A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary J… |
CVE-2019-1003041 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003039 | High | 8.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/… |
CVE-2019-1003038 | High | 7.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins… |
CVE-2019-1003037 | Medium | 6.5 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java… |
CVE-2019-1003036 | Medium | 4.3 | 2019-03-08 | A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java tha… |
CVE-2019-1003035 | Medium | 4.3 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTempl… |
CVE-2019-1003034 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.g… |
CVE-2019-1003033 | High | 8.8 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that all… |
CVE-2019-1003032 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublish… |
CVE-2019-1003031 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows a… |
CVE-2019-1003030 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroov… |
CVE-2019-1003029 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/G… |
CVE-2019-1003028 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthen… |
CVE-2019-1003027 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Ove… |
CVE-2019-1003026 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers… |
CVE-2019-1003025 | High | 8.8 | 2019-02-20 | A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allo… |
CVE-2019-1003024 | High | 8.8 | 2019-02-20 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overa… |
CVE-2019-1003023 | Medium | 6.1 | 2019-02-06 | A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/mode… |
CVE-2019-1003022 | Medium | 6.5 | 2019-02-06 | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on th… |
CVE-2019-1003021 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that… |
CVE-2019-1003020 | Medium | 4.3 | 2019-02-06 | A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with… |
CVE-2019-1003019 | Medium | 5.9 | 2019-02-06 | An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attacker… |
CVE-2019-1003018 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that all… |
CVE-2019-1003017 | Medium | 5.3 | 2019-02-06 | A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconf… |
CVE-2019-1003016 | High | 8.8 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImp… |
CVE-2019-1003015 | Critical | 9.1 | 2019-02-06 | An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/Re… |
CVE-2019-1003014 | Medium | 4.8 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly t… |
CVE-2019-1003013 | Medium | 5.4 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/s… |
CVE-2019-1003012 | Medium | 6.5 | 2019-02-06 | A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/j… |
CVE-2019-1003011 | High | 8.1 | 2019-02-06 | An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenma… |
CVE-2019-1003009 | High | 7.4 | 2019-02-06 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/Ac… |
CVE-2019-1003008 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/war… |
CVE-2019-1003007 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that… |
CVE-2019-1003006 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attac… |
CVE-2019-1003005 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/S… |
CVE-2019-1003004 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProces… |
CVE-2019-1003003 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMe… |
CVE-2019-1003002 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipe… |
CVE-2019-1003001 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, s… |
CVE-2019-1003000 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySan… |
CVE-2017-2652 | High | 8.8 | 2018-07-27 | It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork C… |
CVE-2017-2650 | High | 8.5 | 2018-07-27 | It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well… |
CVE-2017-2649 | High | 8.1 | 2018-07-27 | It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby e… |