Jenkins Project
Page 5 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30514 | High | 7.5 | 2023-04-12 | Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mod… |
CVE-2023-30513 | High | 7.5 | 2023-04-12 | Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for… |
CVE-2023-28684 | Medium | 6.5 | 2023-04-02 | Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28683 | High | 8.2 | 2023-04-02 | Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28682 | High | 8.2 | 2023-04-02 | Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28681 | High | 8.2 | 2023-04-02 | Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28680 | High | 7.5 | 2023-04-02 | Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-28679 | Medium | 5.4 | 2023-04-02 | Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expres… |
CVE-2023-28678 | Medium | 5.4 | 2023-04-02 | Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cro… |
CVE-2023-28677 | Critical | 9.8 | 2023-04-02 | Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-buil… |
CVE-2023-28676 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freest… |
CVE-2023-28675 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf ser… |
CVE-2023-28674 | High | 8.8 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously… |
CVE-2023-28673 | Medium | 4.3 | 2023-04-02 | A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-28672 | Medium | 6.5 | 2023-04-02 | Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with O… |
CVE-2023-28671 | Medium | 4.3 | 2023-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-28670 | Medium | 5.4 | 2023-04-02 | Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a st… |
CVE-2023-28669 | Medium | 5.4 | 2023-04-02 | Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2023-28668 | Critical | 9.8 | 2023-04-02 | Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled. |
CVE-2023-28685 | High | 7.1 | 2023-03-22 | Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-27905 | Critical | 9.6 | 2023-03-10 | Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross… |
CVE-2023-27904 | Medium | 5.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing… |
CVE-2023-27903 | Medium | 4.4 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27902 | Medium | 4.3 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission… |
CVE-2023-27901 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27900 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27899 | High | 7.0 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created f… |
CVE-2023-27898 | Critical | 9.6 | 2023-03-10 | Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when renderi… |
CVE-2023-25768 | Medium | 6.5 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2023-25767 | High | 8.8 | 2023-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-… |
CVE-2023-25766 | Medium | 4.3 | 2023-02-15 | A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2023-25765 | Critical | 9.9 | 2023-02-15 | In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able t… |
CVE-2023-25764 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template re… |
CVE-2023-25763 | Medium | 5.4 | 2023-02-15 | Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting… |
CVE-2023-25762 | Medium | 5.4 | 2023-02-15 | Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in… |
CVE-2023-25761 | Medium | 5.4 | 2023-02-15 | Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scriptin… |
CVE-2023-24459 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2023-24458 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2023-24457 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in t… |
CVE-2023-24456 | Critical | 9.8 | 2023-01-26 | Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. |
CVE-2023-24455 | Medium | 4.3 | 2023-01-26 | Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configur… |
CVE-2023-24454 | Medium | 5.5 | 2023-01-26 | Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controll… |
CVE-2023-24453 | Medium | 6.5 | 2023-01-26 | A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2023-24452 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2023-24451 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2023-24450 | Medium | 6.5 | 2023-01-26 | Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wit… |
CVE-2023-24449 | Medium | 4.3 | 2023-01-26 | Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Over… |
CVE-2023-24448 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24447 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP… |
CVE-2023-24446 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's ac… |
CVE-2023-24445 | Medium | 6.1 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2023-24444 | Critical | 9.8 | 2023-01-26 | Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24443 | Critical | 9.8 | 2023-01-26 | Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24442 | Medium | 5.5 | 2023-01-26 | Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted… |
CVE-2023-24441 | Critical | 9.8 | 2023-01-26 | Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24440 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form… |
CVE-2023-24439 | Medium | 5.5 | 2023-01-26 | Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins contro… |
CVE-2023-24438 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to… |
CVE-2023-24437 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an att… |
CVE-2023-24436 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2023-24435 | Medium | 6.5 | 2023-01-26 | A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2023-24434 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-s… |
CVE-2023-24433 | Medium | 6.5 | 2023-01-26 | Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24432 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-24431 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-24430 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24429 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2023-24428 | Medium | 5.7 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the att… |
CVE-2023-24427 | Critical | 9.8 | 2023-01-26 | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
CVE-2023-24426 | High | 8.8 | 2023-01-26 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. |
CVE-2023-24425 | Medium | 6.5 | 2023-01-26 | Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing… |
CVE-2023-24424 | High | 8.8 | 2023-01-26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24423 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by… |
CVE-2023-24422 | High | 8.8 | 2023-01-26 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission t… |
CVE-2022-46688 | Medium | 6.5 | 2022-12-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerr… |
CVE-2022-46687 | Medium | 5.4 | 2022-12-12 | Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting… |
CVE-2022-46686 | Medium | 5.4 | 2022-12-12 | Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties an… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-46684 | Medium | 5.4 | 2022-12-12 | Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting… |
CVE-2022-46683 | Medium | 6.1 | 2022-12-12 | Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45401 | Medium | 5.4 | 2022-11-15 | Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-45400 | Critical | 9.8 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45399 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
CVE-2022-45398 | Medium | 4.3 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster St… |
CVE-2022-45397 | Critical | 9.8 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45396 | Critical | 9.8 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45395 | Critical | 9.8 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45394 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. |
CVE-2022-45393 | Low | 3.5 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
CVE-2022-45392 | Medium | 6.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller whe… |
CVE-2022-45391 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation… |
CVE-2022-45390 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-45389 | Medium | 5.3 | 2022-11-15 | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-spe… |
CVE-2022-45388 | High | 7.5 | 2022-11-15 | Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read a… |
CVE-2022-45387 | Medium | 5.4 | 2022-11-15 | Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site… |
CVE-2022-45386 | Medium | 5.5 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45385 | High | 7.5 | 2022-11-15 | A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of… |
CVE-2022-45384 | Medium | 6.5 | 2022-11-15 | Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-45383 | Medium | 6.5 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downlo… |