Jenkins Project
Page 6 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24433 | Medium | 6.5 | 2023-01-26 | Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2023-24432 | High | 8.8 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HT… |
CVE-2023-24431 | Medium | 4.3 | 2023-01-26 | A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2023-24430 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-24429 | Critical | 9.8 | 2023-01-26 | Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about t… |
CVE-2023-24428 | Medium | 5.7 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the att… |
CVE-2023-24427 | Critical | 9.8 | 2023-01-26 | Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. |
CVE-2023-24426 | High | 8.8 | 2023-01-26 | Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. |
CVE-2023-24425 | Medium | 6.5 | 2023-01-26 | Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing… |
CVE-2023-24424 | High | 8.8 | 2023-01-26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. |
CVE-2023-24423 | Medium | 6.5 | 2023-01-26 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by… |
CVE-2023-24422 | High | 8.8 | 2023-01-26 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission t… |
CVE-2022-46688 | Medium | 6.5 | 2022-12-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerr… |
CVE-2022-46687 | Medium | 5.4 | 2022-12-12 | Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting… |
CVE-2022-46686 | Medium | 5.4 | 2022-12-12 | Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties an… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-46684 | Medium | 5.4 | 2022-12-12 | Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting… |
CVE-2022-46683 | Medium | 6.1 | 2022-12-12 | Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45401 | Medium | 5.4 | 2022-11-15 | Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-45400 | Critical | 9.8 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45399 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
CVE-2022-45398 | Medium | 4.3 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster St… |
CVE-2022-45397 | Critical | 9.8 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45396 | Critical | 9.8 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45395 | Critical | 9.8 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45394 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. |
CVE-2022-45393 | Low | 3.5 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
CVE-2022-45392 | Medium | 6.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller whe… |
CVE-2022-45391 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation… |
CVE-2022-45390 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-45389 | Medium | 5.3 | 2022-11-15 | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-spe… |
CVE-2022-45388 | High | 7.5 | 2022-11-15 | Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read a… |
CVE-2022-45387 | Medium | 5.4 | 2022-11-15 | Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site… |
CVE-2022-45386 | Medium | 5.5 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45385 | High | 7.5 | 2022-11-15 | A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of… |
CVE-2022-45384 | Medium | 6.5 | 2022-11-15 | Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-45383 | Medium | 6.5 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downlo… |
CVE-2022-45382 | Medium | 5.4 | 2022-11-15 | Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a store… |
CVE-2022-45381 | High | 8.1 | 2022-11-15 | Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Confi… |
CVE-2022-45380 | Medium | 5.4 | 2022-11-15 | Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored… |
CVE-2022-45379 | High | 7.5 | 2022-11-15 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collisi… |
CVE-2022-38666 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several f… |
CVE-2022-43435 | Medium | 5.3 | 2022-10-19 | Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43434 | Medium | 5.3 | 2022-10-19 | Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in work… |
CVE-2022-43433 | Medium | 4.3 | 2022-10-19 | Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43432 | Medium | 4.3 | 2022-10-19 | Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archi… |
CVE-2022-43431 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read per… |
CVE-2022-43430 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43429 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43428 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43427 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/R… |
CVE-2022-43426 | Medium | 5.3 | 2022-10-19 | Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture… |
CVE-2022-43425 | Medium | 5.4 | 2022-10-19 | Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying p… |
CVE-2022-43424 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing… |
CVE-2022-43423 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it… |
CVE-2022-43422 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attack… |
CVE-2022-43421 | Medium | 5.3 | 2022-10-19 | A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose confi… |
CVE-2022-43420 | Medium | 5.4 | 2022-10-19 | Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resul… |
CVE-2022-43419 | Medium | 6.5 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-43418 | Medium | 4.3 | 2022-10-19 | A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2022-43417 | Medium | 4.3 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-43416 | High | 8.8 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with… |
CVE-2022-43415 | High | 7.5 | 2022-10-19 | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43414 | Medium | 5.3 | 2022-10-19 | Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing a… |
CVE-2022-43413 | Medium | 4.3 | 2022-10-19 | Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-43412 | Medium | 5.3 | 2022-10-19 | Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… |
CVE-2022-43411 | Medium | 5.3 | 2022-10-19 | Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal… |
CVE-2022-43410 | Medium | 5.3 | 2022-10-19 | Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook end… |
CVE-2022-43409 | Medium | 5.4 | 2022-10-19 | Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in buil… |
CVE-2022-43408 | Medium | 6.5 | 2022-10-19 | Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipel… |
CVE-2022-43407 | High | 8.8 | 2022-10-19 | Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is use… |
CVE-2022-43406 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to defin… |
CVE-2022-43405 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted… |
CVE-2022-43404 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 118… |
CVE-2022-43403 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allo… |
CVE-2022-43402 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b… |
CVE-2022-43401 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a… |
CVE-2022-41255 | Medium | 6.5 | 2022-09-21 | Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users… |
CVE-2022-41254 | Medium | 6.5 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP ser… |
CVE-2022-41253 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server… |
CVE-2022-41252 | Medium | 4.3 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stor… |
CVE-2022-41251 | Medium | 4.3 | 2022-09-21 | A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IDs of credentials s… |
CVE-2022-41250 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified H… |
CVE-2022-41249 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP se… |
CVE-2022-41248 | Medium | 5.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers… |
CVE-2022-41247 | Medium | 4.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where the… |
CVE-2022-41246 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2022-41245 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacke… |
CVE-2022-41244 | High | 8.1 | 2022-09-21 | Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abuse… |
CVE-2022-41243 | High | 8.1 | 2022-09-21 | Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a ma… |
CVE-2022-41242 | Medium | 5.4 | 2022-09-21 | A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job n… |
CVE-2022-41241 | Critical | 9.1 | 2022-09-21 | Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41240 | Medium | 5.4 | 2022-09-21 | Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2022-41239 | Medium | 5.4 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause… |
CVE-2022-41238 | Critical | 9.8 | 2022-09-21 | A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker… |
CVE-2022-41237 | Critical | 9.8 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2022-41236 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated… |
CVE-2022-41235 | Medium | 5.3 | 2022-09-21 | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file s… |
CVE-2022-41234 | High | 8.8 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trig… |