Jenkins Project
Page 4 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40346 | Medium | 5.4 | 2023-08-16 | Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2023-40345 | Medium | 6.5 | 2023-08-16 | Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access… |
CVE-2023-40344 | Medium | 4.3 | 2023-08-16 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2023-40343 | Medium | 5.9 | 2023-08-16 | Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers… |
CVE-2023-40342 | Medium | 5.4 | 2023-08-16 | Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site s… |
CVE-2023-40341 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, cap… |
CVE-2023-40340 | High | 7.5 | 2023-08-16 | Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build lo… |
CVE-2023-40339 | High | 7.5 | 2023-08-16 | Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files… |
CVE-2023-40338 | Medium | 4.3 | 2023-08-16 | Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Sca… |
CVE-2023-40337 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. |
CVE-2023-40336 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. |
CVE-2023-39156 | Medium | 5.3 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags. |
CVE-2023-39155 | Medium | 5.3 | 2023-07-26 | Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it. |
CVE-2023-39154 | Medium | 6.5 | 2023-07-26 | Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to con… |
CVE-2023-39153 | Medium | 5.4 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to… |
CVE-2023-39152 | Medium | 6.5 | 2023-07-26 | Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the bui… |
CVE-2023-39151 | Medium | 5.4 | 2023-07-26 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in… |
CVE-2023-37965 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2023-37964 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL us… |
CVE-2023-37963 | Medium | 5.4 | 2023-07-12 | A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37962 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37961 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attac… |
CVE-2023-37960 | Medium | 6.5 | 2023-07-12 | Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins contr… |
CVE-2023-37959 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37958 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37957 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37956 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2023-37955 | Medium | 6.5 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-speci… |
CVE-2023-37954 | Medium | 4.3 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build. |
CVE-2023-37953 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usin… |
CVE-2023-37952 | Medium | 6.5 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2023-37951 | Medium | 6.5 | 2023-07-12 | Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access… |
CVE-2023-37950 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials… |
CVE-2023-37949 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2023-37948 | Low | 3.7 | 2023-07-12 | Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle at… |
CVE-2023-37947 | Medium | 6.1 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins… |
CVE-2023-37946 | High | 8.8 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. |
CVE-2023-37945 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to dow… |
CVE-2023-37944 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL us… |
CVE-2023-37943 | Medium | 5.9 | 2023-07-12 | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory u… |
CVE-2023-37942 | Medium | 6.5 | 2023-07-12 | Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-3315 | Medium | 4.3 | 2023-06-19 | Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attack… |
CVE-2023-35149 | Medium | 6.5 | 2023-06-14 | A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an… |
CVE-2023-35148 | Medium | 6.5 | 2023-06-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to connect to an attac… |
CVE-2023-35147 | Medium | 6.5 | 2023-06-14 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with I… |
CVE-2023-35146 | Medium | 5.4 | 2023-06-14 | Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in… |
CVE-2023-35145 | Medium | 5.4 | 2023-06-14 | Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in… |
CVE-2023-35144 | Medium | 5.4 | 2023-06-14 | Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, result… |
CVE-2023-35143 | Medium | 5.4 | 2023-06-14 | Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, result… |
CVE-2023-35142 | High | 8.1 | 2023-06-14 | Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. |
CVE-2023-35141 | High | 8.0 | 2023-06-14 | In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insuffi… |
CVE-2023-33007 | Medium | 5.4 | 2023-05-16 | Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-33006 | Medium | 5.4 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker'… |
CVE-2023-33005 | Medium | 5.4 | 2023-05-16 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. |
CVE-2023-33004 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. |
CVE-2023-33003 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics. |
CVE-2023-33002 | Medium | 5.4 | 2023-05-16 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2023-33001 | High | 7.5 | 2023-05-16 | Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode… |
CVE-2023-33000 | High | 7.5 | 2023-05-16 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the pote… |
CVE-2023-32999 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-32998 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and s… |
CVE-2023-32997 | High | 8.8 | 2023-05-16 | Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. |
CVE-2023-32996 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requ… |
CVE-2023-32995 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request wi… |
CVE-2023-32994 | Low | 3.7 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configur… |
CVE-2023-32993 | Medium | 4.8 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve… |
CVE-2023-32992 | High | 8.8 | 2023-05-16 | Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to… |
CVE-2023-32991 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an a… |
CVE-2023-32990 | Medium | 6.5 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-32989 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-32988 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-32987 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified L… |
CVE-2023-32986 | High | 8.8 | 2023-05-16 | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowin… |
CVE-2023-32985 | Medium | 4.3 | 2023-05-16 | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Rea… |
CVE-2023-32984 | Medium | 5.4 | 2023-05-16 | Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin… |
CVE-2023-32983 | Medium | 5.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers… |
CVE-2023-32982 | Medium | 4.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be vi… |
CVE-2023-32981 | High | 8.8 | 2023-05-16 | An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as paramete… |
CVE-2023-32980 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified j… |
CVE-2023-32979 | Medium | 4.3 | 2023-05-16 | Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to… |
CVE-2023-32978 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specif… |
CVE-2023-32977 | Medium | 5.4 | 2023-05-16 | Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripti… |
CVE-2023-30532 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to… |
CVE-2023-30531 | Medium | 6.5 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for… |
CVE-2023-30530 | Medium | 4.3 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controlle… |
CVE-2023-30529 | Medium | 4.3 | 2023-04-12 | Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database. |
CVE-2023-30528 | Medium | 6.5 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers t… |
CVE-2023-30527 | Medium | 4.3 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can… |
CVE-2023-30526 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2023-30525 | High | 8.8 | 2023-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL usin… |
CVE-2023-30524 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attacke… |
CVE-2023-30523 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its con… |
CVE-2023-30522 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jo… |
CVE-2023-30521 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corre… |
CVE-2023-30520 | Medium | 5.4 | 2023-04-12 | Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a s… |
CVE-2023-30519 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the at… |
CVE-2023-30518 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-30517 | Medium | 5.3 | 2023-04-12 | Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a confi… |
CVE-2023-30516 | Medium | 6.5 | 2023-04-12 | Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resul… |
CVE-2023-30515 | High | 7.5 | 2023-04-12 | Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |