Jenkins Project
Page 7 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41233 | Medium | 4.3 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permis… |
CVE-2022-41232 | High | 8.0 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jen… |
CVE-2022-41231 | Medium | 5.7 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins control… |
CVE-2022-41230 | Medium | 4.3 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obt… |
CVE-2022-41229 | Medium | 5.4 | 2022-09-21 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build… |
CVE-2022-41228 | High | 8.8 | 2022-09-21 | A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to co… |
CVE-2022-41227 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect t… |
CVE-2022-41226 | Critical | 9.8 | 2022-09-21 | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41225 | Medium | 5.4 | 2022-09-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site… |
CVE-2022-41224 | Medium | 5.4 | 2022-09-21 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting… |
CVE-2022-38665 | Medium | 6.5 | 2022-08-23 | Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2022-38664 | Medium | 5.4 | 2022-08-23 | Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a s… |
CVE-2022-38663 | Medium | 6.5 | 2022-08-23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Passw… |
CVE-2022-36922 | Medium | 6.1 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a ref… |
CVE-2022-36921 | High | 8.1 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2022-36920 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2022-36919 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-36918 | Medium | 4.3 | 2022-07-27 | Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36917 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup. |
CVE-2022-36916 | High | 8.0 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup. |
CVE-2022-36915 | Medium | 4.3 | 2022-07-27 | Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Rea… |
CVE-2022-36914 | Medium | 4.3 | 2022-07-27 | Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overal… |
CVE-2022-36913 | Medium | 4.3 | 2022-07-27 | Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36912 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2022-36911 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-36910 | Medium | 5.4 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read… |
CVE-2022-36909 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of a… |
CVE-2022-36908 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an atta… |
CVE-2022-36907 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2022-36906 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2022-36905 | Medium | 5.4 | 2022-07-27 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact v… |
CVE-2022-36904 | Medium | 4.3 | 2022-07-27 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Ove… |
CVE-2022-36903 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-36902 | Medium | 5.4 | 2022-07-27 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cr… |
CVE-2022-36901 | Medium | 6.5 | 2022-07-27 | Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-36900 | High | 8.2 | 2022-07-27 | Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control… |
CVE-2022-36899 | High | 8.2 | 2022-07-27 | Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to cont… |
CVE-2022-36898 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36897 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate host… |
CVE-2022-36896 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read pe… |
CVE-2022-36895 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36894 | Medium | 6.5 | 2022-07-27 | An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to… |
CVE-2022-36893 | Medium | 4.3 | 2022-07-27 | Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36892 | Medium | 4.3 | 2022-07-27 | Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36891 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/… |
CVE-2022-36890 | Medium | 4.3 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers… |
CVE-2022-36889 | High | 8.8 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowi… |
CVE-2022-36888 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credential… |
CVE-2022-36887 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entr… |
CVE-2022-36886 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of… |
CVE-2022-36885 | Medium | 5.3 | 2022-07-27 | Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are eq… |
CVE-2022-36884 | Medium | 5.3 | 2022-07-27 | The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an at… |
CVE-2022-36883 | High | 7.5 | 2022-07-27 | A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-sp… |
CVE-2022-36882 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an atta… |
CVE-2022-36881 | High | 8.1 | 2022-07-27 | Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle… |
CVE-2022-34818 | Medium | 4.3 | 2022-06-30 | Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall… |
CVE-2022-34817 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
CVE-2022-34816 | Medium | 6.5 | 2022-06-30 | Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed… |
CVE-2022-34815 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, the… |
CVE-2022-34814 | Medium | 4.3 | 2022-06-30 | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re… |
CVE-2022-34813 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XP… |
CVE-2022-34812 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath ex… |
CVE-2022-34811 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Con… |
CVE-2022-34810 | Medium | 6.5 | 2022-06-30 | A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenki… |
CVE-2022-34809 | Medium | 6.5 | 2022-06-30 | Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users wit… |
CVE-2022-34808 | Medium | 4.3 | 2022-06-30 | Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be view… |
CVE-2022-34807 | Medium | 6.5 | 2022-06-30 | Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2022-34806 | Medium | 6.5 | 2022-06-30 | Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-34805 | Medium | 6.5 | 2022-06-30 | Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-34804 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentia… |
CVE-2022-34803 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller wher… |
CVE-2022-34802 | Medium | 4.3 | 2022-06-30 | Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins co… |
CVE-2022-34801 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in… |
CVE-2022-34800 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be vi… |
CVE-2022-34799 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be… |
CVE-2022-34798 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read perm… |
CVE-2022-34797 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34796 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34795 | Medium | 5.4 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scr… |
CVE-2022-34794 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specifie… |
CVE-2022-34793 | High | 8.8 | 2022-06-30 | Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-34792 | High | 8.0 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified UR… |
CVE-2022-34791 | Medium | 5.4 | 2022-06-30 | Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scr… |
CVE-2022-34790 | Medium | 5.4 | 2022-06-30 | Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-34789 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
CVE-2022-34788 | Medium | 5.4 | 2022-06-30 | Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-34787 | Medium | 5.4 | 2022-06-30 | Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vu… |
CVE-2022-34786 | Medium | 5.4 | 2022-06-30 | Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS… |
CVE-2022-34785 | Medium | 4.3 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-34784 | Medium | 5.4 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability expl… |
CVE-2022-34783 | Medium | 5.4 | 2022-06-30 | Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke… |
CVE-2022-34782 | Medium | 4.3 | 2022-06-30 | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending re… |
CVE-2022-34781 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2022-34780 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34779 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34778 | Medium | 5.4 | 2022-06-30 | Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain… |
CVE-2022-34777 | Medium | 5.4 | 2022-06-30 | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross… |
CVE-2022-34213 | Medium | 6.5 | 2022-06-23 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller w… |
CVE-2022-34212 | Medium | 5.7 | 2022-06-23 | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request t… |
CVE-2022-34211 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an a… |