Jenkins Project
Page 4 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46652 | Medium | 4.3 | 2023-10-25 | A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-46651 | Medium | 6.5 | 2023-10-25 | Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to ac… |
CVE-2023-46650 | Medium | 5.4 | 2023-10-25 | Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site script… |
CVE-2023-43502 | Medium | 4.3 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes. |
CVE-2023-43501 | Medium | 6.5 | 2023-09-20 | A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2023-43500 | High | 8.8 | 2023-09-20 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2023-43499 | Medium | 5.4 | 2023-09-20 | Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2023-43498 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temp… |
CVE-2023-43497 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system te… |
CVE-2023-43496 | High | 8.8 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created fi… |
CVE-2023-43495 | Medium | 5.4 | 2023-09-20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a… |
CVE-2023-43494 | Medium | 4.3 | 2023-09-20 | Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter v… |
CVE-2023-41947 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using at… |
CVE-2023-41946 | Low | 3.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Testing using attacker… |
CVE-2023-41945 | High | 8.8 | 2023-09-06 | Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be grante… |
CVE-2023-41944 | Medium | 6.1 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error mess… |
CVE-2023-41943 | Medium | 6.5 | 2023-09-06 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permissi… |
CVE-2023-41942 | Medium | 4.3 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue. |
CVE-2023-41941 | Medium | 4.3 | 2023-09-06 | A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials I… |
CVE-2023-41940 | Medium | 5.4 | 2023-09-06 | Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers a… |
CVE-2023-41939 | High | 8.8 | 2023-09-06 | Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (ty… |
CVE-2023-41938 | Medium | 6.5 | 2023-09-06 | A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. |
CVE-2023-41937 | High | 7.5 | 2023-09-06 | Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including certain URLs, and… |
CVE-2023-41936 | High | 7.5 | 2023-09-06 | Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, poten… |
CVE-2023-41935 | High | 7.5 | 2023-09-06 | Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the… |
CVE-2023-41934 | Medium | 5.3 | 2023-09-06 | Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specifi… |
CVE-2023-41933 | High | 8.8 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-41932 | Medium | 6.5 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attacke… |
CVE-2023-41931 | Medium | 5.4 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when ren… |
CVE-2023-41930 | Medium | 4.3 | 2023-09-06 | Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing… |
CVE-2023-4303 | Medium | 4.3 | 2023-08-21 | Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability. |
CVE-2023-4302 | Medium | 4.2 | 2023-08-21 | A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-4301 | Medium | 4.2 | 2023-08-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2023-40351 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or remove views from ano… |
CVE-2023-40350 | Medium | 5.4 | 2023-08-16 | Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting… |
CVE-2023-40349 | Medium | 5.3 | 2023-08-16 | Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of… |
CVE-2023-40348 | Medium | 5.3 | 2023-08-16 | The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in its output. |
CVE-2023-40347 | Medium | 6.5 | 2023-08-16 | Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… |
CVE-2023-40346 | Medium | 5.4 | 2023-08-16 | Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2023-40345 | Medium | 6.5 | 2023-08-16 | Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read permission to access… |
CVE-2023-40344 | Medium | 4.3 | 2023-08-16 | A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2023-40343 | Medium | 5.9 | 2023-08-16 | Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers… |
CVE-2023-40342 | Medium | 5.4 | 2023-08-16 | Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a stored cross-site s… |
CVE-2023-40341 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, cap… |
CVE-2023-40340 | High | 7.5 | 2023-08-16 | Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build lo… |
CVE-2023-40339 | High | 7.5 | 2023-08-16 | Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files… |
CVE-2023-40338 | Medium | 4.3 | 2023-08-16 | Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Sca… |
CVE-2023-40337 | Medium | 4.3 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder. |
CVE-2023-40336 | High | 8.8 | 2023-08-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders. |
CVE-2023-39156 | Medium | 5.3 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags. |
CVE-2023-39155 | Medium | 5.3 | 2023-07-26 | Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it. |
CVE-2023-39154 | Medium | 6.5 | 2023-07-26 | Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to con… |
CVE-2023-39153 | Medium | 5.4 | 2023-07-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to… |
CVE-2023-39152 | Medium | 6.5 | 2023-07-26 | Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the bui… |
CVE-2023-39151 | Medium | 5.4 | 2023-07-26 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in… |
CVE-2023-37965 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2023-37964 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers to connect to an attacker-specified URL us… |
CVE-2023-37963 | Medium | 5.4 | 2023-07-12 | A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37962 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37961 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attac… |
CVE-2023-37960 | Medium | 6.5 | 2023-07-12 | Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins contr… |
CVE-2023-37959 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2023-37958 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37957 | High | 8.8 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified… |
CVE-2023-37956 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2023-37955 | Medium | 6.5 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers to connect to an attacker-speci… |
CVE-2023-37954 | Medium | 4.3 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier allows attackers to rebuild a previous build. |
CVE-2023-37953 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usin… |
CVE-2023-37952 | Medium | 6.5 | 2023-07-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins mabl Plugin 0.0.46 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2023-37951 | Medium | 6.5 | 2023-07-12 | Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access… |
CVE-2023-37950 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials… |
CVE-2023-37949 | High | 7.1 | 2023-07-12 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2023-37948 | Low | 3.7 | 2023-07-12 | Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle at… |
CVE-2023-37947 | Medium | 6.1 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins… |
CVE-2023-37946 | High | 8.8 | 2023-07-12 | Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. |
CVE-2023-37945 | Medium | 4.3 | 2023-07-12 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to dow… |
CVE-2023-37944 | Medium | 6.5 | 2023-07-12 | A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL us… |
CVE-2023-37943 | Medium | 5.9 | 2023-07-12 | Jenkins Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory u… |
CVE-2023-37942 | Medium | 6.5 | 2023-07-12 | Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-3315 | Medium | 4.3 | 2023-06-19 | Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attack… |
CVE-2023-35149 | Medium | 6.5 | 2023-06-14 | A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an… |
CVE-2023-35148 | Medium | 6.5 | 2023-06-14 | A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers to connect to an attac… |
CVE-2023-35147 | Medium | 6.5 | 2023-06-14 | Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with I… |
CVE-2023-35146 | Medium | 5.4 | 2023-06-14 | Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in… |
CVE-2023-35145 | Medium | 5.4 | 2023-06-14 | Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name for the Log file field form validation, resulting in… |
CVE-2023-35144 | Medium | 5.4 | 2023-06-14 | Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, result… |
CVE-2023-35143 | Medium | 5.4 | 2023-06-14 | Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, result… |
CVE-2023-35142 | High | 8.1 | 2023-06-14 | Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default. |
CVE-2023-35141 | High | 8.0 | 2023-06-14 | In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insuffi… |
CVE-2023-33007 | Medium | 5.4 | 2023-05-16 | Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-33006 | Medium | 5.4 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker'… |
CVE-2023-33005 | Medium | 5.4 | 2023-05-16 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. |
CVE-2023-33004 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics. |
CVE-2023-33003 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics. |
CVE-2023-33002 | Medium | 5.4 | 2023-05-16 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2023-33001 | High | 7.5 | 2023-05-16 | Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode… |
CVE-2023-33000 | High | 7.5 | 2023-05-16 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form, increasing the pote… |
CVE-2023-32999 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2023-32998 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and s… |
CVE-2023-32997 | High | 8.8 | 2023-05-16 | Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. |