Jenkins Project
Page 8 of 16 — Jenkins Project CVEs from a corpus of 1583, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34210 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2022-34209 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34208 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-34207 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34206 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to… |
CVE-2022-34205 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an att… |
CVE-2022-34204 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP serv… |
CVE-2022-34203 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2022-34202 | Medium | 6.5 | 2022-06-23 | Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by… |
CVE-2022-34201 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2022-34200 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2022-34199 | Medium | 6.5 | 2022-06-23 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-34198 | Medium | 5.4 | 2022-06-23 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, res… |
CVE-2022-34197 | Medium | 5.4 | 2022-06-23 | Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resu… |
CVE-2022-34196 | Medium | 5.4 | 2022-06-23 | Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting… |
CVE-2022-34195 | Medium | 5.4 | 2022-06-23 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying para… |
CVE-2022-34194 | Medium | 5.4 | 2022-06-23 | Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displayin… |
CVE-2022-34193 | Medium | 5.4 | 2022-06-23 | Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-34192 | Medium | 5.4 | 2022-06-23 | Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SinglePar… |
CVE-2022-34191 | Medium | 5.4 | 2022-06-23 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters… |
CVE-2022-34190 | Medium | 5.4 | 2022-06-23 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters… |
CVE-2022-34189 | Medium | 5.4 | 2022-06-23 | Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting… |
CVE-2022-34188 | Medium | 5.4 | 2022-06-23 | Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resul… |
CVE-2022-34187 | Medium | 5.4 | 2022-06-23 | Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying… |
CVE-2022-34186 | Medium | 5.4 | 2022-06-23 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displa… |
CVE-2022-34185 | Medium | 5.4 | 2022-06-23 | Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stor… |
CVE-2022-34184 | Medium | 5.4 | 2022-06-23 | Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displayi… |
CVE-2022-34183 | Medium | 5.4 | 2022-06-23 | Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resul… |
CVE-2022-34182 | Medium | 6.1 | 2022-06-23 | Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerabil… |
CVE-2022-34181 | Critical | 9.1 | 2022-06-23 | Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files… |
CVE-2022-34180 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unpro… |
CVE-2022-34179 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without… |
CVE-2022-34178 | Medium | 6.1 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible val… |
CVE-2022-34177 | High | 7.5 | 2022-06-23 | Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller… |
CVE-2022-34176 | Medium | 5.4 | 2022-06-23 | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2022-34175 | High | 7.5 | 2022-06-23 | Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments co… |
CVE-2022-34174 | High | 7.5 | 2022-06-23 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an… |
CVE-2022-34173 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in… |
CVE-2022-34172 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site script… |
CVE-2022-34171 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons i… |
CVE-2022-34170 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is par… |
CVE-2022-30972 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e… |
CVE-2022-30971 | High | 8.8 | 2022-05-17 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-30970 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner f… |
CVE-2022-30969 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without s… |
CVE-2022-30968 | Medium | 5.4 | 2022-05-17 | Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stor… |
CVE-2022-30967 | Medium | 5.4 | 2022-05-17 | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parame… |
CVE-2022-30966 | Medium | 5.4 | 2022-05-17 | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, res… |
CVE-2022-30965 | Medium | 5.4 | 2022-05-17 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters… |
CVE-2022-30964 | Medium | 5.4 | 2022-05-17 | Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulti… |
CVE-2022-30963 | Medium | 5.4 | 2022-05-17 | Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-30962 | Medium | 5.4 | 2022-05-17 | Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayi… |
CVE-2022-30961 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying… |
CVE-2022-30960 | Medium | 5.4 | 2022-05-17 | Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultin… |
CVE-2022-30959 | Medium | 6.5 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2022-30958 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using… |
CVE-2022-30957 | Medium | 4.3 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2022-30956 | Medium | 5.4 | 2022-05-17 | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-30955 | Medium | 6.5 | 2022-05-17 | Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-30954 | Medium | 6.5 | 2022-05-17 | Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-30953 | Medium | 6.5 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP ser… |
CVE-2022-30952 | Medium | 6.5 | 2022-05-17 | Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified… |
CVE-2022-30951 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to… |
CVE-2022-30950 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users ab… |
CVE-2022-30949 | Medium | 5.3 | 2022-05-17 | Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file… |
CVE-2022-30948 | High | 7.5 | 2022-05-17 | Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's fi… |
CVE-2022-30947 | High | 7.5 | 2022-05-17 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file s… |
CVE-2022-30946 | Medium | 4.3 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an… |
CVE-2022-30945 | High | 8.5 | 2022-05-17 | Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sand… |
CVE-2022-29052 | Medium | 4.3 | 2022-04-12 | Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can… |
CVE-2022-29051 | Medium | 4.3 | 2022-04-12 | Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using at… |
CVE-2022-29050 | High | 8.8 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attack… |
CVE-2022-29049 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers… |
CVE-2022-29048 | Medium | 4.3 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2022-29046 | Medium | 5.4 | 2022-04-12 | Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying paramet… |
CVE-2022-29045 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views di… |
CVE-2022-29044 | Medium | 5.4 | 2022-04-12 | Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters… |
CVE-2022-29043 | Medium | 5.4 | 2022-04-12 | Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, result… |
CVE-2022-29042 | Medium | 5.4 | 2022-04-12 | Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator… |
CVE-2022-29041 | Medium | 5.4 | 2022-04-12 | Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displayi… |
CVE-2022-29040 | Medium | 5.4 | 2022-04-12 | Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a store… |
CVE-2022-29039 | Medium | 5.4 | 2022-04-12 | Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, r… |
CVE-2022-29038 | Medium | 5.4 | 2022-04-12 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views display… |
CVE-2022-29037 | Medium | 5.4 | 2022-04-12 | Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a sto… |
CVE-2022-29036 | Medium | 5.4 | 2022-04-12 | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name… |
CVE-2022-28160 | Medium | 6.5 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. |
CVE-2022-28159 | Medium | 5.4 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site… |
CVE-2022-28158 | Medium | 6.5 | 2022-03-29 | A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2022-28157 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller… |
CVE-2022-28156 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenk… |
CVE-2022-28155 | High | 8.1 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28154 | High | 8.1 | 2022-03-29 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28153 | Medium | 5.4 | 2022-03-29 | Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2022-28152 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership… |
CVE-2022-28151 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item… |
CVE-2022-28150 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-sp… |
CVE-2022-28149 | Medium | 5.4 | 2022-03-29 | Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2022-28148 | Medium | 6.5 | 2022-03-29 | The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in… |
CVE-2022-28147 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for t… |