Jenkins Project
Page 5 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32996 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST requ… |
CVE-2023-32995 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request wi… |
CVE-2023-32994 | Low | 3.7 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configur… |
CVE-2023-32993 | Medium | 4.8 | 2023-05-16 | Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve… |
CVE-2023-32992 | High | 8.8 | 2023-05-16 | Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to… |
CVE-2023-32991 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an a… |
CVE-2023-32990 | Medium | 6.5 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-32989 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-32988 | Medium | 4.3 | 2023-05-16 | A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-32987 | High | 8.8 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified L… |
CVE-2023-32986 | High | 8.8 | 2023-05-16 | Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowin… |
CVE-2023-32985 | Medium | 4.3 | 2023-05-16 | Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Rea… |
CVE-2023-32984 | Medium | 5.4 | 2023-05-16 | Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin… |
CVE-2023-32983 | Medium | 5.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers… |
CVE-2023-32982 | Medium | 4.3 | 2023-05-16 | Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller where they can be vi… |
CVE-2023-32981 | High | 8.8 | 2023-05-16 | An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as paramete… |
CVE-2023-32980 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified j… |
CVE-2023-32979 | Medium | 4.3 | 2023-05-16 | Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to… |
CVE-2023-32978 | Medium | 4.3 | 2023-05-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specif… |
CVE-2023-32977 | Medium | 5.4 | 2023-05-16 | Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripti… |
CVE-2023-30532 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to… |
CVE-2023-30531 | Medium | 6.5 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for… |
CVE-2023-30530 | Medium | 4.3 | 2023-04-12 | Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controlle… |
CVE-2023-30529 | Medium | 4.3 | 2023-04-12 | Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database. |
CVE-2023-30528 | Medium | 6.5 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers t… |
CVE-2023-30527 | Medium | 4.3 | 2023-04-12 | Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can… |
CVE-2023-30526 | Medium | 6.5 | 2023-04-12 | A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2023-30525 | High | 8.8 | 2023-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL usin… |
CVE-2023-30524 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attacke… |
CVE-2023-30523 | Medium | 4.3 | 2023-04-12 | Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its con… |
CVE-2023-30522 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jo… |
CVE-2023-30521 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corre… |
CVE-2023-30520 | Medium | 5.4 | 2023-04-12 | Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a s… |
CVE-2023-30519 | Medium | 5.3 | 2023-04-12 | A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the at… |
CVE-2023-30518 | Medium | 4.3 | 2023-04-12 | A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials ID… |
CVE-2023-30517 | Medium | 5.3 | 2023-04-12 | Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a confi… |
CVE-2023-30516 | Medium | 6.5 | 2023-04-12 | Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resul… |
CVE-2023-30515 | High | 7.5 | 2023-04-12 | Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30514 | High | 7.5 | 2023-04-12 | Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30513 | High | 7.5 | 2023-04-12 | Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for… |
CVE-2023-28684 | Medium | 6.5 | 2023-04-02 | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28683 | High | 8.2 | 2023-04-02 | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28682 | High | 8.2 | 2023-04-02 | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28681 | High | 8.2 | 2023-04-02 | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28680 | High | 7.5 | 2023-04-02 | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28679 | Medium | 5.4 | 2023-04-02 | Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expres… |
CVE-2023-28678 | Medium | 5.4 | 2023-04-02 | Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cro… |
CVE-2023-28677 | Critical | 9.8 | 2023-04-02 | Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-buil… |
CVE-2023-28676 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freest… |
CVE-2023-28675 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf ser… |
CVE-2023-28674 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously… |
CVE-2023-28673 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-28672 | Medium | 6.5 | 2023-04-02 | Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with O… |
CVE-2023-28671 | Medium | 4.3 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-28670 | Medium | 5.4 | 2023-04-02 | Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a st… |
CVE-2023-28669 | Medium | 5.4 | 2023-04-02 | Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-28668 | Critical | 9.8 | 2023-04-02 | Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. |
CVE-2023-28685 | High | 7.1 | 2023-03-22 | Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-27905 | Critical | 9.6 | 2023-03-10 | Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross… |
CVE-2023-27904 | Medium | 5.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing… |
CVE-2023-27903 | Medium | 4.4 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27902 | Medium | 4.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission… |
CVE-2023-27901 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27900 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27899 | High | 7.0 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27898 | Critical | 9.6 | 2023-03-10 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when renderi… |
CVE-2023-25768 | Medium | 6.5 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2023-25767 | High | 8.8 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-… |
CVE-2023-25766 | Medium | 4.3 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2023-25765 | Critical | 9.9 | 2023-02-15 | In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able t… |
CVE-2023-25764 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template re… |
CVE-2023-25763 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting… |
CVE-2023-25762 | Medium | 5.4 | 2023-02-15 | Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in… |
CVE-2023-25761 | Medium | 5.4 | 2023-02-15 | Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scriptin… |
CVE-2023-24459 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-24458 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-24457 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in t… |
CVE-2023-24456 | Critical | 9.8 | 2023-01-26 | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
CVE-2023-24455 | Medium | 4.3 | 2023-01-26 | Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configur… |
CVE-2023-24454 | Medium | 5.5 | 2023-01-26 | Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controll… |
CVE-2023-24453 | Medium | 6.5 | 2023-01-26 | A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2023-24452 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-24451 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2023-24450 | Medium | 6.5 | 2023-01-26 | Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wit… |
CVE-2023-24449 | Medium | 4.3 | 2023-01-26 | Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Over… |
CVE-2023-24448 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24447 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP… |
CVE-2023-24446 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's ac… |
CVE-2023-24445 | Medium | 6.1 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2023-24444 | Critical | 9.8 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24443 | Critical | 9.8 | 2023-01-26 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24442 | Medium | 5.5 | 2023-01-26 | Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted… |
CVE-2023-24441 | Critical | 9.8 | 2023-01-26 | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24440 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form… |
CVE-2023-24439 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins contro… |
CVE-2023-24438 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2023-24437 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an att… |
CVE-2023-24436 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-24435 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-24434 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-s… |