Jenkins Project
Page 6 of 16 — Jenkins Project CVEs from a corpus of 1545, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45382 | Medium | 5.4 | 2022-11-15 | Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a store… |
CVE-2022-45381 | High | 8.1 | 2022-11-15 | Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Confi… |
CVE-2022-45380 | Medium | 5.4 | 2022-11-15 | Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored… |
CVE-2022-45379 | High | 7.5 | 2022-11-15 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collisi… |
CVE-2022-38666 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several f… |
CVE-2022-43435 | Medium | 5.3 | 2022-10-19 | Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43434 | Medium | 5.3 | 2022-10-19 | Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in work… |
CVE-2022-43433 | Medium | 4.3 | 2022-10-19 | Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43432 | Medium | 4.3 | 2022-10-19 | Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archi… |
CVE-2022-43431 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read per… |
CVE-2022-43430 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43429 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43428 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43427 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/R… |
CVE-2022-43426 | Medium | 5.3 | 2022-10-19 | Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture… |
CVE-2022-43425 | Medium | 5.4 | 2022-10-19 | Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying p… |
CVE-2022-43424 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing… |
CVE-2022-43423 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it… |
CVE-2022-43422 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attack… |
CVE-2022-43421 | Medium | 5.3 | 2022-10-19 | A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose confi… |
CVE-2022-43420 | Medium | 5.4 | 2022-10-19 | Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resul… |
CVE-2022-43419 | Medium | 6.5 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-43418 | Medium | 4.3 | 2022-10-19 | A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2022-43417 | Medium | 4.3 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-43416 | High | 8.8 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with… |
CVE-2022-43415 | High | 7.5 | 2022-10-19 | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43414 | Medium | 5.3 | 2022-10-19 | Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing a… |
CVE-2022-43413 | Medium | 4.3 | 2022-10-19 | Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-43412 | Medium | 5.3 | 2022-10-19 | Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… |
CVE-2022-43411 | Medium | 5.3 | 2022-10-19 | Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal… |
CVE-2022-43410 | Medium | 5.3 | 2022-10-19 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook end… |
CVE-2022-43409 | Medium | 5.4 | 2022-10-19 | Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in buil… |
CVE-2022-43408 | Medium | 6.5 | 2022-10-19 | Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipel… |
CVE-2022-43407 | High | 8.8 | 2022-10-19 | Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is use… |
CVE-2022-43406 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to defin… |
CVE-2022-43405 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted… |
CVE-2022-43404 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 118… |
CVE-2022-43403 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allo… |
CVE-2022-43402 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b… |
CVE-2022-43401 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a… |
CVE-2022-41255 | Medium | 6.5 | 2022-09-21 | Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users… |
CVE-2022-41254 | Medium | 6.5 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP ser… |
CVE-2022-41253 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server… |
CVE-2022-41252 | Medium | 4.3 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stor… |
CVE-2022-41251 | Medium | 4.3 | 2022-09-21 | A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IDs of credentials s… |
CVE-2022-41250 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified H… |
CVE-2022-41249 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP se… |
CVE-2022-41248 | Medium | 5.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers… |
CVE-2022-41247 | Medium | 4.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where the… |
CVE-2022-41246 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2022-41245 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacke… |
CVE-2022-41244 | High | 8.1 | 2022-09-21 | Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abuse… |
CVE-2022-41243 | High | 8.1 | 2022-09-21 | Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a ma… |
CVE-2022-41242 | Medium | 5.4 | 2022-09-21 | A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job n… |
CVE-2022-41241 | Critical | 9.1 | 2022-09-21 | Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41240 | Medium | 5.4 | 2022-09-21 | Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2022-41239 | Medium | 5.4 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause… |
CVE-2022-41238 | Critical | 9.8 | 2022-09-21 | A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker… |
CVE-2022-41237 | Critical | 9.8 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2022-41236 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated… |
CVE-2022-41235 | Medium | 5.3 | 2022-09-21 | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file s… |
CVE-2022-41234 | High | 8.8 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trig… |
CVE-2022-41233 | Medium | 4.3 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permis… |
CVE-2022-41232 | High | 8.0 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jen… |
CVE-2022-41231 | Medium | 5.7 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins control… |
CVE-2022-41230 | Medium | 4.3 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obt… |
CVE-2022-41229 | Medium | 5.4 | 2022-09-21 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build… |
CVE-2022-41228 | High | 8.8 | 2022-09-21 | A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to co… |
CVE-2022-41227 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect t… |
CVE-2022-41226 | Critical | 9.8 | 2022-09-21 | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41225 | Medium | 5.4 | 2022-09-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site… |
CVE-2022-41224 | Medium | 5.4 | 2022-09-21 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting… |
CVE-2022-38665 | Medium | 6.5 | 2022-08-23 | Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2022-38664 | Medium | 5.4 | 2022-08-23 | Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a s… |
CVE-2022-38663 | Medium | 6.5 | 2022-08-23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Passw… |
CVE-2022-36922 | Medium | 6.1 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a ref… |
CVE-2022-36921 | High | 8.1 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2022-36920 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2022-36919 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-36918 | Medium | 4.3 | 2022-07-27 | Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36917 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup. |
CVE-2022-36916 | High | 8.0 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup. |
CVE-2022-36915 | Medium | 4.3 | 2022-07-27 | Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Rea… |
CVE-2022-36914 | Medium | 4.3 | 2022-07-27 | Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overal… |
CVE-2022-36913 | Medium | 4.3 | 2022-07-27 | Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36912 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2022-36911 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-36910 | Medium | 5.4 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read… |
CVE-2022-36909 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of a… |
CVE-2022-36908 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an atta… |
CVE-2022-36907 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2022-36906 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2022-36905 | Medium | 5.4 | 2022-07-27 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact v… |
CVE-2022-36904 | Medium | 4.3 | 2022-07-27 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Ove… |
CVE-2022-36903 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-36902 | Medium | 5.4 | 2022-07-27 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cr… |
CVE-2022-36901 | Medium | 6.5 | 2022-07-27 | Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-36900 | High | 8.2 | 2022-07-27 | Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control… |
CVE-2022-36899 | High | 8.2 | 2022-07-27 | Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to cont… |
CVE-2022-36898 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |